CMU Resolution 452 and State Quality Assurance (GQA): How Ukrainian Defense Manufacturers Transition to NATO STANAG 4107 and AQAP 2110

CMU Resolution 452 moved State Quality Assurance (Державне гарантування якості or ДГЯ, known across NATO as Government Quality Assurance or GQA) from high-level policy declarations into a binding operational procedure for defense contractors. The government's Procedure for State Quality Assurance under CMU Resolution No. 452 establishes an explicit legal definition of quality assurance standards. Under this rule, those standards are directly NATO AQAP-series publications (Allied Quality Assurance Publications), together with Ukrainian national and military standards that are identical translations of the AQAP series.

For defense plant directors, chief engineers, and quality managers, this closes a multi-year regulatory gap. Previously, Ukrainian defense manufacturers operated in a split reality. The foundational Law of Ukraine "On Defense Procurement" No. 808-IX introduced the legal concept of State Quality Assurance back in 2020 (Article 1) and gave state customers the authority to include NATO quality assurance certificates as selection criteria (Article 17). Yet on the shop floor, verification remained tied either to legacy military representative inspections (ВП МОУ) or to emergency wartime acceptance rules.

Today, the regulatory chain is complete. Alongside the wartime contracting regime governed by CMU Resolution No. 1275 on defense procurement under martial law and framework procurement notices published on Prozorro, the Ministry of Defense now holds an operational mechanism to evaluate a supplier's quality management system (QMS) against AQAP 2110. The regulation covers both domestic state contracts with Ukrainian producers and foreign economic contracts signed with defense companies from NATO member states and partner nations.

From Policy Declaration to Contractual Mechanism in Defense Procurement Agencies

In practice, the consequence for suppliers is straightforward: whenever the Defense Procurement Agency (АОЗ), the State Logistics Operator (ДОТ), or another state customer inserts a State Quality Assurance clause into a defense contract, the supplier audit maps directly to military standard ВСТ 01.057.004-2021(01). That military standard adopted NATO AQAP-2110 Edition D and standardization agreement STANAG 4107 Edition 13 in Ukraine as an identical translation (marked IDT).

Many manufacturers search for AQAP 2110 inside civilian ДСТУ catalogs, don't see it there, and assume the standard hasn't taken effect yet. That assumption can cost you a contract. ВСТ 01.057.004-2021(01) is an active military standard enacted by Order No. 70 of the Ministry of Defense Directorate for Standardization, Codification, and Cataloguing on 17 November 2021. If your company is moving from ad-hoc wartime batches toward multi-year state contracts, European defense joint ventures, or NATO Support and Procurement Agency (NSPA) tenders, you should start preparing for GQA with a technical diagnostic audit led by Ekontrol.

To grasp the engineering shift behind CMU Resolution 452, compare legacy post-Soviet inspections by military representations (ВП МОУ) with NATO's Government Quality Assurance model under STANAG 4107. Under the old GOST RV inheritance, the military representative acted like an external quality control department stationed inside the plant. The inspector checked finished batches item by item, stamped logbooks, and signed acceptance acts. Once that stamp hit the page, responsibility for hidden field failures blurred between the manufacturer and the military inspectorate.

After 2022, Ukraine's defense industrial base expanded from a few dozen state enterprises to more than 800 private manufacturers building unmanned aerial vehicles, ground robotic systems, electronic warfare (EW) suites, armored vehicles, and ammunition. The legacy model hit a physical wall. No military directorate has enough staff to station an officer next to every surface-mount PCB line or FPV drone assembly bench. Worse still, 100% visual inspection of a finished drone at the shipping dock can't detect micro-voids in BGA solder joints, unapproved microchip substitutions, or a race condition inside autopilot firmware.

The STANAG 4107 and AQAP 2070 architecture codified in the Procedure under CMU Resolution No. 452 flips that model upside down. In NATO procurement, one rule is absolute: the contractor bears 100% responsibility for product quality, and state verification never transfers legal or warranty liability away from the manufacturer. The Government Quality Assurance Representative (GQAR, or представник з ДГЯ) doesn't replace your factory quality control team. Instead, the GQAR audits whether your engineering and manufacturing processes can reliably produce conforming hardware, focusing surveillance on high-risk process nodes.

Seven Stages of the State Quality Assurance Procedure Under CMU Resolution 452

Under Clause 5 of the Procedure, State Quality Assurance isn't a single committee visit. It runs across the contract lifecycle through seven structured stages:

1. Establishing quality assurance requirements based on risk identification and analysis. Before signing the contract, the state customer evaluates technical complexity, mission criticality, and process maturity in line with AQAP 2070.
2. Forming an official request for State Quality Assurance work. The customer transmits technical specifications, contract clauses, and the risk profile to the authorized Ministry of Defense GQA body.
3. Developing a tailored GQA plan of measures and work. The assigned GQAR defines process audit schedules, Hold Points, Witness Points, and acceptance trial protocols.
4. Assessing the conformity of the bidder's or contractor's quality management system (QMS). Auditors evaluate the factory on site against AQAP 2110 (ВСТ 01.057.004-2021).
5. Continuous monitoring of the contractor's QMS during contract execution. The GQAR tracks how the plant handles engineering changes, incoming component verification, metrological calibration, and corrective actions (CAPA) during serial production.
6. Inspecting manufacturing processes and critical operations. Targeted verification of special processes, bench tests, and proving-ground trials.
7. Compiling final reporting materials and issuing the QMS certificate. When the contractor passes QMS conformity assessment, the authorized body issues a Certificate of Conformity valid for three years (Clause 36 of the Procedure).

NATO AQAP standards don't stand alone. They are built as a modular defense layer on top of ISO 9001. When you open military standard ВСТ 01.057.004-2021(01) (AQAP 2110 Edition D), you'll see direct references to Clauses 4 through 10 of ISO 9001:2015, each expanded with military-engineering requirements. Depending on what you supply, the Ministry of Defense or a NATO partner applies specific standards from the AQAP family.

AQAP 2110 (ВСТ 01.057.004-2021(01)) is the primary standard for defense contractors engaged in design, research and development (R&D), modernization, and serial manufacturing of weapons and military equipment. It governs the full engineering lifecycle: translating tactical and technical requirements (ТТЗ) into design baselines, validating special manufacturing processes, running acceptance trials, and managing post-delivery support.

AQAP 2131 (NATO Quality Assurance Requirements for Final Inspection and Test) applies to lower-complexity procurement. State customers invoke it when buying commercial off-the-shelf (COTS) goods, standard spare parts, raw materials, or simple assemblies where the supplier doesn't perform design work or complex special processes, and where final batch inspection and functional testing suffice to verify conformity.

AQAP 2210 (NATO Supplementary Software Quality Assurance Requirements to AQAP 2110) has become essential for Ukrainian defense tech companies. Every modern unmanned aerial system, ground robot, electronic intelligence (ELINT) station, automated turret, or tactical radio runs on embedded firmware and mission software. A memory leak in flight-controller code or a frequency-hopping failure under jamming destroys an airframe just as surely as a structural wing failure. AQAP 2210 requires a documented Software Quality Assurance Plan (SQAP), strict configuration control of source code and compiled binaries, automated regression testing after every patch, separation of development and production environments, and verifiable cybersecurity controls over code repositories.

What AQAP 2110 Adds Beyond the ISO 9001:2015 Baseline

Holding a civilian ISO 9001 certificate gives a manufacturer roughly 65% to 70% of the structural foundation. The remaining 30% to 35% of AQAP 2110 requirements are the exact areas where unprepared suppliers fail during a State Quality Assurance audit:

• Unconditional Right of Access (Clause 9.4 of AQAP 2110). The contractor must grant the GQAR and customer representatives unrestricted access to production lines, warehouses, testing facilities, engineering drawings, and quality records tied to the contract, along with office space and calibrated verification equipment.
• Supply Chain Flow-Down (Clause 8.4). When a prime contractor buys critical sub-assemblies (such as thermal imaging cores, propulsion motors, armor plate, or multilayer PCBs) from subcontractors, the prime must flow down applicable AQAP requirements into purchase orders and secure right of access for the state GQAR to inspect sub-tier facilities.
• Contract-Specific Risk Management (Clause 6.1). While ISO 9001 only asks for general organizational risk thinking, AQAP 2110 requires a documented technical, production, and supply-chain risk register for the specific contract, shared with and reviewed by the GQAR.
• Deliverable Quality Plans (AQAP 2105) and Configuration Management (ISO 10007). These two engineering pillars connect high-level QMS procedures to the exact drawings, bill of materials, and firmware hashes of the contracted product.

One of the first operational milestones under the Procedure approved by CMU Resolution No. 452 is submitting a Deliverable Quality Plan before serial production begins. The rules for this document sit in Clause 5.4 of AQAP 2110 and in NATO standard AQAP 2105 (NATO Requirements for Deliverable Quality Plans).

A Deliverable Quality Plan isn't your company-wide ISO 9001 Quality Manual. A Quality Manual describes how your organization operates in general; a Quality Plan is engineered for a specific defense contract and a specific product baseline (for example, a contract for 500 reconnaissance fixed-wing UAVs or 40 armored evacuation vehicles). It shows the GQAR the exact inspection checkpoints, test protocols, and configuration controls that govern that specific order from raw material receipt to final Certificate of Conformity sign-off.

Under AQAP 2105, an acceptable Quality Plan must define:

1. Product baseline identification, listing active technical specifications (ТУ), drawing packages, hardware revisions, and firmware build identifiers.
2. Engineering authority matrix, naming the quality director or chief engineer authorized to halt production, manage quarantine, and sign the Certificate of Conformity (CoC).
3. Process flow chart and inspection checkpoints, mapping incoming inspection, in-process verification, climatic or bench burn-in, and final acceptance tests.
4. Control of Special Processes. Special processes are manufacturing operations whose output cannot be fully verified by subsequent non-destructive inspection of the finished item: welding ballistic armor steel, reflow soldering BGA microchips, vacuum infusion and curing of carbon-fiber airframes, conformal coating of tactical electronics, or pressing energetic materials. For each special process, the Quality Plan must reference equipment validation protocols, operator qualification certificates, and continuous parameter logs.
5. Schedule of Hold Points and Witness Points agreed with the Government Quality Assurance Representative.

Common Mistakes Defense Contractors Make When Submitting Quality Plans

During turnkey QMS implementation projects, Ekontrol auditors consistently see three failure modes that trigger formal rejection of a Quality Plan by Ministry of Defense GQA specialists. First, contractors submit a generic 15-page template copied from civilian ISO 9001 that contains zero references to actual drawing numbers, sampling plans, or acceptance test procedures.

Second, manufacturers describe final screwdriver assembly in detail while omitting sub-tier control over outsourced PCB assembly, CNC machining, or heat treatment. Third, the draft plan lacks a clear failure-response protocol explaining how the factory isolates a lot if a sample fails periodic environmental or ballistic trials. Under AQAP 2110, the GQAR has the right to reject an inadequate Quality Plan, legally freezing serial production launch until every engineering gap is corrected.

Ask any lead defense auditor which AQAP 2110 clause causes the biggest shock for fast-growing Ukrainian miltech producers, and the answer is always Configuration Management under ISO 10007 (ДСТУ ISO 10007). During the early stages of the war, engineering teams got used to improvising on the fly: if a supplier delayed video transmitters or flight controllers on Monday, engineers sourced an alternative chip on Tuesday, modified the PCB layout on Wednesday, flashed updated firmware on Thursday, and shipped the batch to the front on Friday.

In volunteer deliveries, that speed saved lives. Inside a formal state contract under CMU Resolution No. 1275 and State Quality Assurance under CMU Resolution No. 452, unapproved component substitution is a severe breach of contract that halts batch acceptance and triggers financial penalties. Frontline units require hardware with predictable tactical performance, interchangeable spare parts, and identical operator behavior.

Configuration Management under ISO 10007 and Clause 7.7 / 8.1 of AQAP 2110 requires four integrated engineering processes:

1. Configuration Identification. The manufacturer defines Configuration Items (CIs), meaning the hardware assemblies, sub-assemblies, and software modules tracked as distinct units. You establish a formal Product Baseline: the frozen set of approved drawings, Bill of Materials (BOM), electrical schematics, PCB Gerber files, and cryptographic SHA-256 hashes of compiled firmware builds.
2. Configuration Control. No change to the approved Product Baseline may enter the shop floor without a documented Engineering Change Proposal (ECP). NATO practice divides changes into two classes. Class I Changes affect form, fit, function, tactical performance, weight, center of gravity, ballistic protection, safety, reliability, interchangeability, or contract price. You cannot implement a Class I change without prior written approval from the state customer and concurrence from the GQAR. Class II Changes cover minor documentation corrections or non-critical tolerances that don't alter form, fit, function, or interchangeability, though they still require internal engineering registration.
3. Configuration Status Accounting (CSA). This provides bi-directional lot and serial traceability. Given any deployed unit's serial number, your factory must produce its complete genealogy within minutes: raw material heat numbers, PCB batch numbers, installed firmware version, operator IDs, and calibration dates of test benches. Conversely, if a batch of battery cells or fuzes shows a defect in the field, CSA identifies every serial unit containing components from that specific lot.
4. Configuration Verification and Audit. Before serial release, the contractor conducts a Functional Configuration Audit (FCA, proving through test reports that the item meets all tactical-technical requirements) and a Physical Configuration Audit (PCA, verifying that the physical production unit matches the approved drawing package down to the last fastener).

The Risk of Unapproved Component Substitutions in UAVs and Electronic Warfare Systems

Here is the most common scenario that blocks payment on defense contracts today: midway through a six-month contract, a drone or EW manufacturer faces a shortage of a specific GNSS module or DC-DC converter listed in the codified BOM. The purchasing team buys a drop-in replacement without filing a Class I Engineering Change Proposal or notifying the GQAR. During a process inspection or teardown audit, the GQAR compares the physical board against the approved Product Baseline, logs a major configuration non-conformity, and refuses to countersign the Certificate of Conformity. Millions of hryvnias in finished hardware sit frozen in quarantine until the manufacturer completes repeat qualification testing and formalizes the baseline change.

Discussions around CMU Resolution No. 452 frequently confuse two separate certificates that share similar names but serve distinct legal functions. The first is the QMS Certificate of Conformity (Clause 36 of the Procedure). The authorized body of the Ministry of Defense issues this certificate for a three-year term after your company passes an on-site audit against ВСТ 01.057.004-2021(01) (AQAP 2110). It confirms that your management system is capable of executing defense contracts.

The second document is the Delivery Certificate of Conformity (CoC) governed by STANAG 4107 and Clause 8.6 of AQAP 2110 (alongside the manufacturer's quality certificate required under CMU Resolution No. 1275). The manufacturer issues this CoC for every batch or serial unit shipped to the military customer.

In NATO procurement, a delivery CoC contains two formal parts:

• Part 1 (Contractor's Statement of Conformity). An authorized company official (typically the Head of Quality or Chief Engineer named in the Quality Plan) signs a legally binding declaration stating that the delivered batch conforms in full to contract clauses, the approved Product Baseline, and all required test protocols, except for specific deviations explicitly authorized via numbered Concessions.
• Part 2 (GQAR Endorsement). When the contract mandates State Quality Assurance surveillance at the plant, the GQAR completes Part 2 of the CoC, confirming that all scheduled GQA verification activities for that batch were completed satisfactorily.

Concession and Deviation Permits, Quarantine, and Material Review Board Procedures

What happens when your quality control team detects a departure from an approved drawing during production (for example, protective paint thickness measures 45 microns instead of 50 microns, or an enclosure bracket uses a substitute alloy) that doesn't impair combat effectiveness or safety? Under Clause 8.7 of AQAP 2110, a contractor is strictly forbidden from accepting that hardware internally "use as is" and shipping it unannounced to the customer.

Any item departing from the approved baseline is classified as Non-Conforming Product. Workers must tag it immediately and move it into a physically locked Quarantine Area isolated from normal production and shipping inventory. Next, your internal Material Review Board (MRB) performs an engineering evaluation. If the company wishes to deliver the affected units, it must submit a formal Request for Concession (or Deviation Permit before manufacturing) detailing the technical deviation, supporting test data, root-cause corrective actions, and any price adjustment. You may ship those units only after receiving written Concession approval from the customer and GQAR, and the approved Concession number must be recorded directly on the delivery Certificate of Conformity (CoC).

While the legal framework of CMU Resolution No. 452 and military standard ВСТ 01.057.004-2021(01) applies uniformly across defense procurement, the technical content of a Quality Plan and GQAR inspection checklist varies sharply by industry sector. Across Ekontrol's consulting projects with Ukrainian defense producers, five sector-specific compliance profiles stand out.

UAVs (FPV, fixed-wing reconnaissance, heavy strike drones) and Ground Robotic Systems (UGVs). Many drone builders scaled rapidly under simplified wartime rules in CMU Resolution No. 1275, shipping against a manufacturer's quality certificate. As procurement shifts toward multi-year state contracts, partner-funded procurements (such as the Danish model), and European joint ventures, GQA auditors focus on batch-to-batch repeatability, embedded software control under AQAP 2210, aerospace manufacturing discipline under AS 9100 (Foreign Object Debris / FOD prevention in motors and airframes, First Article Inspection / FAI under AS9102), and incoming load-bench verification of brushless motors, ESCs, and lithium battery packs.

Armored Vehicles, Artillery Systems, and Heavy Engineering. Here, State Quality Assurance centers on metallurgical traceability of ballistic steel (mill test certificates to EN 10204 Type 3.1 or 3.2), validation of welding special processes under ISO 3834, welder certification, 100% non-destructive testing (NDT via ultrasonic and radiographic inspection) of hull seams, and proving-ground endurance runs.

Military Electronics, Electronic Warfare (EW / РЕБ), Tactical Communications, and Thermal Optics. The primary threat in defense electronics is counterfeit, remarked, or salvaged microchips entering the assembly line from gray-market brokers and failing under thermal shock or vibration. An AQAP 2110 system in this sector requires counterfeit part prevention procedures (modeled on AS5553), Electrostatic Discharge (ESD) protection across assembly rooms (IEC 61340), soldering inspection to IPC-A-610 Class 3 (high-reliability aerospace and military electronic assemblies), automated conformal coating thickness control, and environmental stress screening.

Ammunition, Energetic Materials, and Pyrotechnics. Classified at the highest risk tier under AQAP 2070, ammunition contracts require lot homogeneity control of propellants and explosives, moisture and chemical stability verification, multi-stage fuze safety testing, 100% lot genealogy, and live-fire ballistic acceptance trials backed by accredited laboratories and proving grounds.

Tactical Gear and Personal Ballistic Protection (Body Armor, Ballistic Helmets). Suppliers contracting with the State Logistics Operator (ДОТ) must maintain roll-to-vest traceability of para-aramid (Kevlar, Twaron) and ultra-high-molecular-weight polyethylene (UHMWPE) ballistic fabrics, press-cycle logging for helmet shells, near-infrared (NIR) spectral reflectance control on Cordura fabrics, and batch ballistic V50 and backface signature testing (under ДСТУ 8782 and STANAG 2920) performed strictly in accredited ballistic testing facilities.

Meeting NATO quality assurance rules doesn't mean running three disconnected sets of binders in your factory. Mature defense contractors build a single Integrated Management System (IMS) where each standard addresses a distinct engineering layer.

The base layer is ISO 9001, which establishes the core process architecture: document control, organizational context, leadership accountability, competence management, internal auditing, and corrective actions. The second layer is AQAP 2110, which adds the contractual interface with the Ministry of Defense and NATO customers: Deliverable Quality Plans (AQAP 2105), ISO 10007 configuration management, AQAP 2070 risk registers, GQAR right of access, and Certificates of Conformity (CoC).

The third layer applies to aviation, unmanned aerial systems, missiles, and defense avionics: aerospace standard AS 9100 (published in Europe as EN 9100). While AQAP 2110 governs how you demonstrate contract assurance to a government customer, AS 9100 provides hard shop-floor engineering tools. Specifically, AS 9100 mandates standardized First Article Inspection (FAI under AS9102) before serial production starts, systematic Foreign Object Debris (FOD) prevention programs, management of Critical Items and critical drawing characteristics, and strict counterfeit electronic component prevention controls.

Role of NAAU-Accredited ISO/IEC 17025 Laboratories in Defense Conformity Verification

No Certificate of Conformity (CoC) holds up during a State Quality Assurance audit if the underlying test data came from uncalibrated benches or unvalidated test methods. Clause 7.1.5 of AQAP 2110 and the Procedure under CMU Resolution No. 452 place strict requirements on monitoring and measuring resources.

To prove tactical and technical performance during qualification, periodic, and lot acceptance trials, a defense supplier must rely on testing and calibration laboratories operating in compliance with ISO/IEC 17025. In Ukraine, official accreditation of testing and calibration laboratories is performed by the National Accreditation Agency of Ukraine (NAAU), a full signatory to the European co-operation for Accreditation (EA MLA) and ILAC MRA mutual recognition arrangements.

Even when a manufacturer runs in-house bench tests inside its own factory testing unit without a separate NAAU accreditation certificate, GQA auditors verify whether those internal test operations follow core ISO/IEC 17025 principles: unbroken metrological traceability to national or international measurement standards, strict adherence to calibration intervals, environmental monitoring (temperature, humidity, EMI) inside test rooms, calculation of measurement uncertainty, and tamper-proof retention of raw digital test logs. For producers of ballistic protection, ammunition, UAV propulsion, and tactical electronics, establishing an ISO/IEC 17025 laboratory or contracting with NAAU-accredited test centers eliminates disputes during state acceptance.

The costliest mistake a defense executive can make is waiting until an AQAP 2110 or State Quality Assurance requirement appears in a Prozorro framework tender or a direct Defense Procurement Agency contract with a 20-day submission deadline. You can't buy a working configuration management system, metrological chain, and lot traceability architecture as a pre-printed binder in two weeks. GQA representatives inspect live shop-floor records, quarantine cages, calibration certificates, and component genealogy.

Ekontrol has developed a five-stage engineering roadmap to prepare Ukrainian defense manufacturers for AQAP 2110 (ВСТ 01.057.004-2021) certification and State Quality Assurance assessment under CMU Resolution No. 452:

1. Stage 1: Technical Diagnostic Audit (Gap Analysis, 3-5 business days). Our lead auditors evaluate your production lines, design documentation (КД/ТД), incoming inspection, quarantine controls, metrology, and ERP traceability against ВСТ 01.057.004-2021(01). You receive an itemized gap report, work breakdown schedule, and fixed project budget.
2. Stage 2: QMS Architecture and Configuration Management Design (1.5-2 months). During turnkey implementation, we build procedures around your actual hardware and engineering workflows. We develop your Configuration Management Plan under ISO 10007 (Product Baseline definition, Class I and Class II ECP workflows, Configuration Status Accounting), contract risk assessment rules under AQAP 2070, subcontractor flow-down clauses, and Deliverable Quality Plan templates under AQAP 2105.
3. Stage 3: Shop-Floor Rollout, Metrology, and Laboratory Integration (1.5-2 months). We train design engineers, technologists, quality inspectors, and warehouse staff on the new controls. We set up physical quarantine areas, Concession request workflows, and Certificate of Conformity (CoC) release procedures. Where required, we prepare your in-house testing laboratories for accreditation under ISO/IEC 17025.
4. Stage 4: Internal Audit and Mock GQA Inspection (2-3 weeks). Ekontrol auditors conduct a full dress rehearsal of a Ministry of Defense GQA evaluation: tracing a random finished serial number backward to raw material certificates, verifying special process validation logs, checking Hold Point records, and reviewing software baselines under AQAP 2210. All findings are closed through corrective actions before official auditors arrive.
5. Stage 5: Full Audit Support During Certification and GQA Assessment. We stand beside your engineering team during third-party ISO 9001 / AQAP 2110 certification and during the authorized body's GQA conformity assessment to secure your three-year QMS Certificate of Conformity under Clause 36 of the Procedure.

Timeline and Resource Allocation: Realistic Schedule for AQAP 2110 Compliance

For a defense manufacturer operating a genuine, working ISO 9001 system, building and validating the AQAP 2110 layer takes 3.5 to 5 months. If your company scaled rapidly from an R&D startup and needs to build both core QMS processes and ISO 10007 configuration management from scratch, expect a 5 to 7 month timeline depending on product complexity and number of production sites.

Investing in AQAP 2110 pays back on your very first serial defense contract: your plant eliminates batch rejections, prevents line stoppages from unapproved part swaps, secures a three-year QMS Certificate of Conformity under CMU Resolution No. 452, and qualifies for NATO NSPA and European defense supply chains. Reach out to the Ekontrol engineering team via our contact page to schedule your initial diagnostic audit and protect your upcoming defense contracts.