Japan Market-Entry Brief

Japan holds two statuses in the US defense system. Both are real. Neither does what a supplier hopes it does.

The first is procurement. DFARS 225.003 defines a qualifying country as one with a reciprocal defense-procurement agreement with the United States, in which both countries agree to remove barriers to purchases of supplies produced in the other country. Japan is on that list, current as of DFARS Change 5/7/2026. Your parts get a procurement preference against Buy American restrictions.

The second is alliance. The State Department designates Japan a Major Non-NATO Ally under 22 U.S.C. 2321k and 10 U.S.C. 2350a, one of nineteen countries carrying the designation. Look at what it grants: cooperative research and development agreements with the Department of Defense, and the right to bid on maintenance, repair, and overhaul of US defense equipment outside the United States. Real privileges, precisely drawn. Not one of them is permission to hold US controlled technical data.

This is the part that decides your build, and the part most suppliers get wrong. The ITAR names allies. It does not name them equally.

Part 126 carries the country-specific exemptions. Canada has one, at 22 CFR 126.5. Australia and the United Kingdom have one, at 22 CFR 126.7, and each also holds a Defense Trade Cooperation Treaty exemption, at 126.16 and 126.17. Even the expedited license processing at 126.15 names Australia, the United Kingdom, and Canada. Japan is on none of them.

Japan does appear, at 22 CFR 126.14, covering special comprehensive export authorizations for NATO members, Australia, Japan, and Sweden. Read that section closely. Those are authorizations the Directorate of Defense Trade Controls may provide, on request, to a registered US exporter. The holder is always the American company. It is a mechanism for an American firm to export toward you, not a license exemption, and not yours to hold.

A Japanese parent therefore runs under the standard ITAR regime. For a Canadian supplier, the US-person data boundary is one part of the build. For you, it is the build.

Japan and the United States are deepening defense-industrial cooperation, and the direction of that work decides whether this page applies to you. On April 14, 2026, the two governments held the fourth Defense Industrial Cooperation, Acquisition, and Sustainment plenary and upgraded the framework to DICAS 2.0. The missile working group scoped circuit card assembly into AIM-120 AMRAAM co-production, on a feasibility study run with Mitsubishi Electric and Raytheon, and is weighing Final Assembly and Check-Out in Japan. In December 2025 a Japanese company repaired the USS Fitzgerald at Maizuru, the first time a Japanese firm repaired a US Navy vessel homeported in the mainland United States. The aircraft working group is pursuing an F100 and F110 engine repair hub in Japan.

Every one of those wins moves American program work into Japanese plants, through the primes and through government agreements. That is good news, and it is a different transaction from the one on this page. It does not put your company on a US prime's domestic supplier list, and it does not move your controlled technical data into the United States.

A second control regime sits on this route, and it is your own. Japan controls the overseas transfer of defense equipment and technology under the Three Principles on Transfer of Defense Equipment and Technology, revised in December 2023 and again on April 21, 2026. Whether they reach a transfer from your company to your own US subsidiary belongs to your export-control counsel in Japan. My part is different: I design the operation so that whatever the answer turns out to be, the workflow enforces it. Two governments control this route, and one digital thread has to satisfy both by design.

Start with what the regulation says about foreign ownership. DFARS 225.003 defines a domestic concern to include a concern incorporated in the United States, and it is explicit: a subsidiary incorporated in the United States counts, even if the parent corporation is a foreign concern. Foreign ownership does not disqualify your US operation. What you build inside it decides your position.

The US-person data boundary is the center of that build, and for a Japanese group it is usually the hardest part. If your design authority sits in Japan and your group runs one IT tenant across every site, the boundary is not a setting someone switches on. It is a decision about where work happens, which drawings live where, and who may open them. I scope the CUI enclave tight around the controlled data, so the assessment stays small and the parent's access is governed by design rather than by exception.

CMMC is in motion, and the accurate read is worth more than the headline. On July 13, 2026, the Department suspended Phase 2 of CMMC, the phase that would have required third-party certification, and opened a reform review. Phase 1 stands, and the obligation underneath it did not move: an operation handling CUI is still bound by DFARS clause 252.204-7012, still implements the 110 controls in NIST SP 800-171 Revision 2, and still self-assesses and posts its score to SPRS. A suspended assessment phase is not a suspended control. Build to the controls, and whatever the regime settles into becomes a reporting exercise instead of a rebuild.

Japan is a market I serve, and my operating record is Canadian and Italian. I am standing up US defense manufacturing operations for a Canadian-parent subsidiary now, and I ran the North America operations of an Italian sensor and automation multinational with a plant in New England. I say that plainly, because you are deciding who to trust with your controlled data.