AUSA opens doors. Whether a deal follows is often decided by people who never visit the booth.
Thomas Riebs, JD · Managing Partner
The most welcome sentence at a defense show is often spoken by an engineer: Can you send us the drawings? It sounds like progress, and it is. It is also the first compliance decision of the relationship.
Some European exhibitors are hearing it at AUSA, the Association of the United States Army’s annual meeting in Washington, D.C., from October 12 to 14. A U.S. prime contractor, a company holding contracts directly with the Pentagon, wants to see how the exhibitor’s component would fit a program.
Drawings of a military or dual-use product may need an export authorization from the exhibitor’s own government before they are sent to the United States. If the prime answers with controlled technical data of its own, it may need U.S. government authorization before its engineers can press send. Neither question will be settled at the booth, and neither can be left to lawyers alone.
The short version
In U.S. defense, a buyer inherits your export restrictions, your cybersecurity, and your supply chain along with your product, so compliance is part of what you sell. The decisions that shape it are made in engineering, IT, purchasing, sales, and leadership, with lawyers advising rather than deciding. Make them before the sales conversation starts, and you become the easier supplier to buy from.
The buyer inherits four risks with your part
When an American prime adds a European component to a program, it inherits four risks along with the part: whether the technical data can cross borders, whether the supplier can protect defense information, whether the sourcing works under U.S. procurement rules, and whether the supplier’s statements will remain true once written into a contract.
Those risks are assessed by people an exhibitor rarely meets: a trade compliance office that decides what may be shared with foreign companies, even in a U.S. meeting room; a supply chain team that approves suppliers; and a security team that must write the Pentagon’s cybersecurity requirements into contracts with suppliers handling sensitive, unclassified defense information, including suppliers abroad.
If a supplier mishandles controlled data, the prime answers for it. The engineer signals interest. The engineer’s colleagues test readiness.
The decisions that matter most are not legal ones
European defense suppliers are not newcomers to compliance simply because they are new to the U.S. market.
I trained as a lawyer, and I would not hand U.S. defense compliance to lawyers alone. Legal advice establishes what a rule requires, and it is indispensable. But the choices that decide which rules apply, and whether a company can meet them, are made elsewhere.
Engineering decides whether to accept American technical data into the design. If it does, U.S. rules can attach to the finished product and follow it into the company’s other markets, which makes it a board decision.
IT decides where defense information would be stored and whether those systems meet U.S. protection requirements.
Management decides who works on a U.S. program. Under U.S. export rules, who may see a controlled drawing can depend on the person’s nationality, and European employment and data protection law limits how that question can be asked and acted on.
Purchasing decides where materials come from. From January 2027, Pentagon restrictions on certain magnets, tantalum, and tungsten from China, Russia, North Korea, and Iran reach back to where the material was mined and refined. A supplier that cannot trace its materials cannot tell the buyer whether its product qualifies.
Sales decides what to promise in the first meetings, such as calling a product “ITAR-free.” Those promises reappear in questionnaires, proposals, and contracts as formal statements the company is accountable for.
None of these is a legal decision. Each has legal consequences, and some are serious. In September, an aerospace company agreed to pay more than USD 2 million to resolve U.S. Department of Justice allegations that it fell short of cybersecurity requirements in a Pentagon contract.
Each function may be doing its job well. The usual failure is timing: compliance is asked to check the deal after sales has shaped it, instead of helping to shape it.
Certifications can wait for an opportunity. Decisions cannot.
There is a serious argument for doing nothing until a customer asks. Most trade show conversations will not become contracts. Requirements depend on the contract and cannot be fully known in advance. And the rules are moving. In July, the Pentagon suspended the next phase of its Cybersecurity Maturity Model Certification program, CMMC, which would have required third-party certification from November 10, pending the outcome of a review. On October 1, the State Department proposed revisions to how U.S. arms export rules define what they control.
Obviously, there is little value in investing in certifications that may never be relevant.
But that argument confuses two kinds of preparation. Certifications cost money and can often wait until a specific opportunity requires them. Decisions cost attention and cannot wait, because the buyer’s first request requires them. Classifying the product, deciding what you will send and receive, and naming who approves an answer do not depend on the rules standing still.
The July suspension makes the point very clearly by pausing a deadline but leaving the obligation. Contractors must still protect the defense information their contracts cover, as the Pentagon itself stated.
The ready supplier is the easier one to choose
Consider two European suppliers with comparable technology and prices. One starts investigating its export status when the prime’s compliance office asks. The other arrives with its product classified, a clear position on what it can send and receive, and an executive who can approve a data exchange within days.
Neither is guaranteed a contract. But the prime’s program manager has a schedule, and its compliance office has a queue. Compliance rarely wins a contract by itself. It decides whether your technology is still competing when the decision is made.
Preparation also finds advantages. Denmark, Finland, France, Germany, Norway, Sweden, the United Kingdom, and many other European countries have reciprocal defense procurement agreements with the United States. Under the Pentagon’s Buy American rules, components made there can count alongside American ones when a prime calculates domestic content. A supplier that knows this can say so in the first meeting.
Three questions for leadership to settle before the buyer asks
1. What can we show, send, and receive?
You probably know your national classification. Establish the U.S. one, for the product and its technical data: U.S. Munitions List, Commerce Control List, or neither. Decide what can be shown at a booth, what can be sent after a meeting, and whether you will accept controlled American technical data into your design. Name who approves each.
2. What obligations might follow, and which will we accept?
Understand your likely role, the information you would need to protect, and the conditions that could attach to your product: limits on who may work on it, a separate U.S. version, restrictions on where it can be sold. Some will change the business case. Know which before the buyer asks.
3. Who makes the decision when the buyer asks?
Establish how sales, engineering, IT, management, and legal advisers will work together, and who has the final word. A question that crosses departments should not become a delay simply because no one owns the answer.
Put each answer, its owner, and a review date on one internal page, because the rules will keep moving. The U.S. regulatory compass describes one way to keep it current.
After AUSA, measure what survives the first request for data
Meetings held at AUSA are a measure of activity. Six months from now, a more useful measure will be how many of those conversations survived their first request for technical data.
The companies that answer that request well may not have the best technology. What they will have is a decision, made before they reply, about what they can share, what they will accept, and who is accountable for it.
If the request comes before those decisions are made, reply with a date, not a drawing: “Let us confirm what we can send. You will have our answer by Friday.”
If one of these questions has no owner in your company yet, that is the conversation worth having.
Regulatory context as of October 12, 2026.
This article is general commentary on business and regulatory developments. It is not legal advice and should not be relied on as legal advice for any specific situation. Although the author is an attorney, publishing this article, reading it, or contacting Traksjon or the author about it does not create an attorney-client relationship. Please do not send confidential information until an engagement has been confirmed in writing. Whether U.S. or European export controls, cybersecurity requirements, or defense contracting rules apply depends on the specific products, information, parties, and contract terms involved. Consult qualified counsel in the relevant jurisdiction before acting on them.
