Garrett Partridge

Country Briefs

Canada Market-Entry Brief

The DFARS says Canada is part of the US defense industrial base. Here is exactly where that stops, and what a Canadian manufacturer still has to build in the United States.

Garrett Partridge · July 16, 2026 · 5 min read · Market-Entry Brief

Often no, and that is the honest answer. A Canadian defense or aerospace manufacturer can sell to the US Department of Defense without a US operation. The DFARS states that for production planning purposes Canada is part of the defense industrial base, the Canadian Commercial Corporation awards and administers US defense contracts with contractors located in Canada, and the Defence Production Sharing Agreement exempts Canadian businesses from Buy American in the defense sector. Every one of those is a procurement instrument. They decide how your proposal is evaluated and how your contract is administered. They do not decide who may see controlled technical data, or where that data is allowed to live. A Canadian manufacturer stands up a US operation when a program needs controlled technical data held inside a US-person boundary, when the Buy American exemption does not reach the item, when a CMMC Level 2 flowdown arrives with a date on it, or when a prime expects its supplier near the line. That build is a US entity, a US-person data boundary, and a floor that runs to a CMMC Level 2 and ITAR-ready posture from the first day it opens.

What Canada actually has

Start with what is true, because it is more than any other ally has. The DFARS is explicit: for production planning purposes, Canada is part of the defense industrial base. That sentence sits in the regulation governing how the Department of Defense contracts with Canadian firms. It is not a trade-association talking point.

The machinery under that sentence is real. The Canadian Commercial Corporation awards and administers US defense contracts with contractors located in Canada, and the Canadian government guarantees CCC's commitments and obligations to the US government on those contracts. The Defence Production Sharing Agreement exempts Canadian businesses from Buy American in the defense sector, which is why a Canadian supplier is treated as a domestic source of supply rather than a foreign one. The Defence Development Sharing Agreement, signed in 1963 by the Secretary of Defense and Canada's Minister of Defence Production, adds that the DoD will evaluate proposals from qualified Canadian firms on a parity with proposals received from United States firms when they bid research and development contracts funded solely by the United States. Canada is also a DFARS qualifying country, which gives qualifying-country end products a procurement preference against Buy American restrictions.

So when a Canadian manufacturer says it is already integrated into the American defense base, that is not optimism. It is the regulation. The question worth asking is narrower, and it is the one this brief answers: integrated for what?

For production planning purposes, Canada is part of the defense industrial base. That is the DFARS, not a brochure. It is also a statement about production planning, and that is exactly where the reading has to stay.

Where the assumption breaks

Every instrument above is a procurement instrument. The DPSA, the DDSA, the CCC channel, and DFARS 225.870 answer one family of questions: who may bid, how a proposal is evaluated, whether Buy American bites, and who administers the contract. They are silent on a different family of questions: who is permitted to see controlled technical data, and what has to be true about the operation holding it.

That second family is where the work is, and it does not care that Canada sits inside the defense industrial base for production planning. Four places the assumption breaks, each of them documented by the same institutions Canadian firms already trust:

  • The Buy American exemption has carve-outs. CCC states plainly that Canadian businesses are not exempt when the product falls under the Berry Amendment or is specifically listed in a DFARS, or when the work requires access to classified information or facilities. If your item sits in one of those categories, the exemption everyone cites does not reach you.
  • The CCC channel has named exceptions. DFARS 225.870-1 routes contracting with Canadian contractors through CCC, then lists what CCC does not award or administer: negotiated acquisitions for experimental, developmental, or research work under projects outside the Defence Development Sharing Program, acquisitions of unusual or compelling urgency, acquisitions at or below the simplified acquisition threshold, and acquisitions made by DoD activities located in Canada.
  • CMMC follows the CUI, not the border. CCC's own guidance to its suppliers is that CMMC requires any contractor and its subcontractors in possession of CUI to meet a specified level at the time of contract award. Selling through a Canadian Crown corporation does not move that obligation off your company.
  • Joint Certification is not a data boundary. CCC refers its suppliers to the US and Canada Joint Certification Program for access to militarily critical technical data. That certification lets you bid and work on such data. It is a different instrument from CMMC, and neither one is a US-person boundary inside a US facility.

The pattern is consistent. Every Canadian arrangement solves market access. None of them solves data custody. When a program needs controlled technical data held inside a US-person boundary, the channel you have been using stops being the answer.

The Canadian exemption is about the border, not the building

The most expensive misreading in this market involves ITAR 22 CFR 126.5, the section titled Canadian exemptions. It is real, it is useful, and it does not do what most people believe it does.

Read the operative paragraphs and the shape is unmistakable. The section permits the temporary import of unclassified Canadian-origin defense articles into the United States and their return to Canada. It permits the permanent and temporary export to Canada, without a license, of unclassified defense articles and defense services identified on the US Munitions List, when the end use is in Canada by a Canadian-registered person or by Canadian federal or provincial governmental authorities acting in an official capacity, or when the article returns to the United States. It excludes items in Supplement No. 1 to Part 126 and exports that transit third countries. Reexport or retransfer to another end user, or from Canada onward to any destination other than the United States, requires prior approval of the Directorate of Defense Trade Controls in all instances. Canadian-registered person is a defined term tied to registration under Canada's Defence Production Act, not a synonym for any Canadian company.

Every one of those provisions moves an article across a border. None of them is permission for your engineers in Canada to open a controlled drawing that lives inside your US subsidiary. Releasing controlled technical data to a foreign person is treated as an export under the ITAR even when nobody leaves the building and nothing ships, and it requires its own authorization. With respect to your US operation, your parent is a foreign person. That is not a technicality. It is the constraint the entire US build is organized around.

22 CFR 126.5 governs what crosses the border. It does not govern who may read a controlled drawing inside your American facility. Scoping which of your data falls where is a question for your export-control counsel, and I coordinate with them. Building the operation so the boundary holds in daily work is mine.

What you build, and when

Onshoring answers a narrow set of triggers, and naming them honestly matters more than selling the build. You stand up a US operation when a program needs controlled technical data held inside a US-person boundary, when the Buy American exemption does not reach your item, when a CMMC Level 2 flowdown arrives with a date on it, or when a prime expects its sub-tier supplier within driving distance of the line. Absent one of those, the CCC channel is doing its job, and I will tell you so.

When a trigger does land, most Canadian sub-tier work falls in one class: controlled technical data, CUI, ITAR-controlled but unclassified. That class needs DDTC registration, a US-person data boundary, and CMMC Level 2 built into the workflow, and a foreign-owned US entity can reach it without a facility clearance. Classified work is a different build that stays with DCSA and your cleared-facility counsel. New England is where the operation goes. My base is Brookline, New Hampshire, and the primes, the supply base, and the compliance depth are already in the corridor. I am currently standing up US defense manufacturing operations for a Canadian-parent subsidiary, so the operating model, the IT and OT build, and the DDTC and FOCI coordination described here are the engagement I am running now.

  • Days 1 to 30, diagnostic and design. The US operating model on paper and on the floor: the org, the value stream, the SQDIP cadence, and the US-person data boundary your ITAR scope needs. With your counsel, map where the CCC channel still carries the work and where it does not.
  • Days 30 to 60, stabilize and build. The IT and OT environment to a CMMC and ITAR-ready posture from day one rather than retrofitted later. Scope the CUI enclave tight so the assessment stays sane and the parent's access is governed by design, not by exception.
  • Days 60 to 90, qualify and run. Sequence the readiness evidence against the prime gate you are actually racing, coordinate the DDTC and FOCI steps with your counsel, and hand your team a floor that holds after I step back.

I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome.

Frequently asked

Direct answers.

Do we need a US operation, or can the Canadian Commercial Corporation sell to the DoD for us?

For a large share of Canadian defense work, the CCC channel is enough, and I will tell you when it is. DFARS 225.870-1 routes contracting with Canadian contractors through CCC, then names what CCC does not award or administer: negotiated acquisitions for experimental, developmental, or research work under projects outside the Defence Development Sharing Program, acquisitions of unusual or compelling urgency, acquisitions at or below the simplified acquisition threshold, and acquisitions made by DoD activities located in Canada. Beyond those exceptions, you stand up a US operation when a program needs controlled technical data held inside a US-person boundary, when a prime expects a supplier near the line, or when a CMMC Level 2 flowdown lands. Those are the cases onshoring solves and the channel does not.

Does the ITAR Canadian exemption let our engineers in Canada work on the technical data our US operation holds?

No, and this is the most common and most expensive misreading in this market. 22 CFR 126.5 is an exemption for moving unclassified US Munitions List articles and defense services to Canada, and for temporarily importing Canadian-origin articles and returning them. It carries its own limits: items in Supplement No. 1 to Part 126 are excluded, exports that transit third countries are excluded, reexport or retransfer requires prior DDTC approval in all instances, and the end use has to be in Canada by a Canadian-registered person as that term is defined, or by Canadian governmental authorities acting in an official capacity. None of it authorizes a foreign parent to reach controlled technical data held inside its US subsidiary. Releasing that data to a foreign person is treated as an export under the ITAR even when nothing physically ships. Which of your data falls where is a question for your export-control counsel.

The DPSA exempts us from Buy American. Does that cover domestic content?

Mostly, and the exceptions are the part that matters. CCC states that Canadian businesses are not exempt from Buy American when the product falls under the Berry Amendment or is specifically listed in a DFARS, or when the work requires access to classified information or facilities. For most defense-sector items the exemption holds and you are treated as a domestic source of supply. If your item sits in one of the carve-outs, the sentence everyone quotes does not apply to you, and that is worth confirming against your actual part numbers before you build a strategy on it.

Does CMMC apply to us if we sell through CCC?

Yes, if you hold CUI. CCC's own guidance to Canadian suppliers is that CMMC requires any contractor and its subcontractors in possession of CUI to meet a specified level at the time of contract award. The obligation follows the data, not the contracting channel. Certification under the US and Canada Joint Certification Program lets you bid and work on militarily critical technical data, and it is a different instrument from CMMC. Neither one is a US-person data boundary. If a prime's flowdown puts a CMMC Level 2 date in front of you, that date is yours.

Sources

Take this with you

Download the print-ready PDF for the boardroom, or put this in front of an operator directly.