^{Published on 22.10.2026}

A product can move from the civilian market into defence use without changing very much physically. What can change significantly is everything around it: how it is developed, documented, tested, changed, produced, and controlled.

This distinction is meaningful for technology companies considering the defence market. A product that has already been successful commercially on one market may still require changes to the company’s ways of working before it can meet the expectations of a defence customer, prime contractor or government quality assurance.

According to Päivi Isomäki, Head of QMS at Innokas, the scale of the change depends heavily on where the company is starting from. Companies already working in highly regulated industries may have many of the necessary practices in place. For companies with less regulated products, the step can be considerably larger.

Start thinking about defense requirements early

AQAP 2110 is the NATO quality management standard. The core idea of it is to provide evidence to defence industry buyers that all contractual quality requirements are fulfilled. It should be part of the conversation as soon as a company decides to pursue defence customers, rather than when a contract is already on the table.

The reason is that building the required practices can take time, and discovering gaps late in the process can affect both the effort required and the economics of the opportunity. Päivi recommends carrying out a preliminary maturity assessment early on to understand where the organization stands.

It is also worth establishing what kind of defence opportunity the company is pursuing. A product sold to a defence organization does not automatically become a defence product. If it qualifies as dual-use goods, the company may also need to consider export controls.

The biggest change may be documentation

One of the most visible differences is the amount of evidence the company needs to maintain, which can represent a significant cultural change.

In a commercial development environment, teams may carry out prototype tests or development activities without formally recording every step. In a defence context, development traceability, up-to-date documentation, production records and configuration control become much more important. Customers or government representatives may also need access to that documentation.

For engineering, this means that decisions need to be explainable and requirements, verification, validation, testing and changes need to leave a clear trail. Changes should follow an established process, with the reasoning and relevant evidence recorded rather than relying on individual expertise or informal decisions.

“The biggest difference is often documentation. You need to be able to show what you have done, why you have done it, and that you have followed the agreed process," Päivi lists.

Risk management becomes broader

Defence applications can also change the questions engineers need to ask about product reliability and use. Risk management may need to cover areas that were less significant in the original commercial application, including software, assembly and the conditions in which the product may be used. Depending on the application, reliability may need to be considered across very different operating or environmental conditions.

The same thinking applies beyond the product itself. Partners, suppliers and subcontractors can become part of the quality picture, with requirements flowing down the supply chain. Customers or government representatives may also audit suppliers, making traceability and control of the wider supply chain important.

The lifecycle may look very different

Defence products can have a very different lifecycle from ordinary commercial products. A product may, for example, be stored for years before it is needed. That raises questions about storage, readiness and how the product’s condition is controlled over time.

This is another area where companies can underestimate the difference between having a technically functioning product and having a product that can be reliably managed throughout its intended lifecycle. Documentation, verification, validation and operational considerations all become part of the picture.

Certification is only a part of the picture

It is important to distinguish between complying with AQAP requirements, having a customer-specific contractual requirement, and holding a certification.

Certification is not necessarily mandatory in every defence arrangement. In some cases, a company may operate as an external provider or supplier without certification. However, the relevant AQAP requirements still need to be followed, and without certification a government quality assurance representative may audit the company directly. Certification can also be an advantage when an acquirer is choosing between suppliers.

This is why sales and management should establish the requirements before committing to an opportunity. They need to understand the company’s role in the supply chain, what requirements apply, what documentation will be expected and how much involvement the customer or government quality assurance organization will have.

You don't have to do everything alone

A company does not necessarily need to rebuild its quality system from scratch before entering the defence market. The first step can be a focused assessment of how well the current organization can document its work and operate according to defined requirements.

External expertise can be useful at this stage, particularly for smaller organizations or companies with limited quality resources. An independent review can help identify the most important gaps and clarify which changes need to be made internally. External support can also be useful for internal audits and management reviews where sufficient independence or expertise is not available in-house. Another option is to work with an existing defence supplier, particularly if the opportunity requires testing or other capabilities the company does not currently have.

Ask whether the opportunity makes sense

Instead of simply asking “Can we get AQAP certification?”, the first question for an engineering or management team should be whether the defense opportunity makes sense for the company, what role the company would have in the supply chain, and what changes that role would require, including whether AQAP certification is part of the requirements.

An early, objective assessment can reveal whether the company can adapt its existing practices, needs specialist support, or would benefit from partnering with an established supplier. Taking that step before committing to a defence opportunity can make the requirements clearer – and give the company more options for responding.

“Take the time to evaluate what is actually needed. Get an external perspective if necessary, understand what it requires from your organization, and then decide whether the opportunity adds enough value," Päivi concludes.