Country Briefs
France Market-Entry Brief
What DFARS qualifying-country status gives a French defense manufacturer, where it stops, and the compliant US operation that wins the DoD sub-tier work.
Garrett Partridge · July 16, 2026 · 5 min read · Market-Entry Brief
A French defense or aerospace manufacturer wins DoD sub-tier work by standing up a compliant US operation: a US entity, a US-person data boundary, and a floor that runs to a CMMC Level 2 and ITAR-ready posture from the first day it opens. France is a DFARS qualifying country, so DoD does not apply Buy American or Balance of Payments restrictions to French qualifying country end products. That preference moves parts across a border. It does not move controlled technical data across the Atlantic, and it waives nothing under ITAR, CMMC, or FOCI. France sits outside AUKUS, so there is no Pillar 2 carve-out to interpret and the standard regime applies. The US-person data boundary is the build.
What qualifying-country status does, and where it stops
France is a founding NATO member and one of the world's most capable defense and aerospace industrial bases. It is also a DFARS qualifying country, and that status is narrower than most parents assume. Under DFARS 225.872-1, DoD does not apply Buy American or Balance of Payments restrictions to qualifying country end products from France, on the strength of memoranda of understanding and other international agreements. France sits on that standing list directly, not on the separate list where the exemption is decided one purchase at a time.
The preference attaches to end products. That is the regulation's own term. It helps the part you ship, and it does nothing for the controlled technical data behind the part. It waives nothing under ITAR, CMMC, or FOCI. A French parent reading qualifying-country status as a shortcut into DoD sub-tier work is reading the wrong regime.
The same rule carries its own limit. DFARS 225.872-1 reserves the authority of the Secretary concerned to restrict an acquisition to domestic sources, or to reject an otherwise acceptable offer from a qualifying country source, when national defense reasons call for it. Qualifying-country status is a preference DoD grants. A US operation is a position you hold.
Qualifying-country status is a procurement preference on your end products. It is not an ITAR waiver, a CMMC waiver, or FOCI clearance. Those regimes still apply, and building for them is the work.
The standard regime, and the class of work you are chasing
France sits outside AUKUS. That makes the French path cleaner to reason about, not harder. There is no Pillar 2 carve-out to interpret and no exception to argue. Controlled French-origin work entering a US defense program runs under the standard ITAR, CMMC, and FOCI regime, and the build is the well-understood one: a US entity, a US-person data boundary, and a CMMC Level 2 floor sized to the work.
Before anyone quotes you a timeline, know which class of work you are chasing. Each class is a different build.
- Class A, commercial and uncontrolled. Dual-use and commercial parts with no controlled technical data. Needs a US entity and a clean quality system. No CMMC boundary, no ITAR registration. Most French parents reach this class on their own.
- Class B, CUI and ITAR-controlled but unclassified. The bulk of sub-tier DoD manufacturing, and where a French parent's US operation lives. Needs DDTC registration, a US-person data boundary, and CMMC Level 2 built into the workflow. A foreign-owned US entity can reach it without a facility clearance. This is the class I build and run.
- Class C, classified. Work that touches classified information. Needs a facility clearance and FOCI mitigation negotiated with DCSA. That is counsel and DCSA territory. I coordinate with your cleared-facility counsel, and the clearance stays with them.
With no carve-out to claim, the French build is the standard build. That is not a disadvantage. It is a known quantity, and a known quantity can be scheduled.
The 90-day operating build
The build installs Standard Work 2.0, the operating system I run in every engagement, across the IT and OT divide. It runs in parallel, not in sequence, because a prime gate does not wait for you to finish one phase before starting the next.
- Days 1 to 30, diagnostic and design. Stand up the US operating model on paper and on the floor: the org, the value stream, the SQDIP cadence, and the US-person data boundary your ITAR scope needs under the standard regime.
- Days 30 to 60, stabilize and build. Bring the IT and OT environment to a CMMC and ITAR-ready posture from day one. Scope the CUI enclave tight around your controlled data, so the assessment stays contained and the parent's access is governed by design.
- Days 60 to 90, qualify and run. Sequence the readiness evidence against the prime gate that is actually in front of you, coordinate the FOCI and DDTC steps with your counsel, and hand your team a floor that holds after I step back.
What I own, and what stays with your counsel
I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for your gate. Entity formation, FOCI mitigation, DDTC licensing determinations, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome. I am an operations architect, and the line between that and legal advice matters in a regulated build.
New England is the landing zone. My base is Brookline, New Hampshire, and I deliver on site across Greater Boston and Southern New Hampshire, where the primes and the regional supply base already are. Six tiers of firms help a French manufacturer enter the US, from FOCI law firms to site-selection consultancies to CMMC IT vendors. None of them stands up and runs the compliant operation. That operating layer is mine.
I have been the foreign parent's operator in the US. I ran the North America operations of GEFRAN, an Italian sensor and automation multinational with a manufacturing plant in New England, so I have stood on the ground a French parent is landing on.
Your controlled technical data stays inside the American operation. Transfers to the parent happen under DDTC authorization or not at all. That is an ITAR-ready posture designed into the workflow, not a guarantee bolted on after.
Frequently asked
Direct answers.
France is a close US ally. Does that reduce the ITAR and CMMC burden?
No. France is a DFARS qualifying country, so DoD does not apply Buy American or Balance of Payments restrictions to French qualifying country end products. That is a procurement preference on the part you ship. It does not reduce the ITAR, CMMC, or FOCI burden on a French-owned US operation, and France sits outside AUKUS, so there is no Pillar 2 carve-out to claim.
We already export to US primes. When do we need a US operation instead?
You stand up a US operation when a program needs controlled technical data held inside a US-person boundary, when a prime expects a supplier with a real US footprint near the line, or when the qualifying-country preference does not reach the requirement in front of you. DFARS 225.872-1 itself reserves DoD's authority to restrict an acquisition to domestic sources for national defense reasons. Exporting sells a part across a border. Onshoring builds the operation, and only that survives a US-person data-access requirement.
Can our French parent see the technical data our US operation holds?
Plan on no by default, and design for it from the first day. I build the US-person data boundary so controlled technical data stays inside the American operation, with transfers to the parent happening under DDTC authorization or not at all. Which data is controlled, and which authorization covers a transfer, is a determination for your export-control counsel. My job is that the boundary lives in the network rather than in a policy document, and that the evidence is there when an assessor asks.
How does an engagement start?
It starts with a strategic conversation. Name your trigger, a prime's interest you cannot capture from abroad, a CMMC flowdown on an RFP, or a US program you are being asked to support with a domestic footprint, and you receive a realistic timing window within 48 hours. Most engagements begin with a 30-Day Operational Triage that produces a defensible written plan. A maximum of four concurrent engagements, every one under NDA.
Sources
- 1. DFARS 225.872-1 General, Buy American and Balance of Payments non-application for qualifying country end products, with France on the standing list at paragraph (a) and the national-defense reservation at paragraph (c) (acquisition.gov, DFARS Change 5/7/2026)
- 2. DFARS 225.003 Definitions, qualifying countries (acquisition.gov, current as of DFARS Change 5/7/2026)
- 3. DoD-CIO Standards Guide for Foreign Partners (2023), the controls overlay for foreign-owned US operations
- 4. DCSA, Foreign Ownership, Control, or Influence (FOCI) and facility-clearance mitigation
- 5. GEFRAN S.p.A., Italian sensor and automation multinational with a manufacturing plant in North Andover, Massachusetts
- 6. US market entry for French defense manufacturers
- 7. The US Market-Entry Playbook for Allied Defense Manufacturers
- 8. One Thread, Two Flags: the US-person data boundary for a foreign-parented defense operation
- 9. Standard Work 2.0, the four-pillar operating method
Take this with you
Download the print-ready PDF for the boardroom, or put this in front of an operator directly.