Spain Market-Entry Brief

Spain is on the list. DFARS 225.872-1 names Spain among the qualifying countries whose end products the Department of Defense buys without applying Buy American restrictions, a determination the regulation attributes to memoranda of understanding and other international agreements. Your parts get read on their merits instead of losing to a domestic-content preference before anyone opens the drawing.

Now read the scope, because the scope is the point. The determination covers the Buy American statute and the Balance of Payments Program, and it covers qualifying country end products. Technical data is not in scope. Qualifying-country status does not register your US entity with the Directorate of Defense Trade Controls, it does not build a data boundary, and it does not assess a single security control. The procurement door is open to Spain. The operating wall behind it is unchanged.

Spain joined NATO in 1982, and Spanish industry sits inside the alliance's programs. Eurofighter is the clearest case: Spain is one of four partner nations alongside the United Kingdom, Germany, and Italy, and NETMA, the NATO Eurofighter and Tornado Management Agency, is the single point of contact for customers and governments. More than four hundred companies across Europe work inside that supply chain.

That is a serious credential, and it is not the credential a DoD contract clause asks for. The clause asks whether a US entity registered with DDTC holds the controlled technical data, whether that data sits inside a US-person boundary, and whether the entity has assessed itself against a specific set of security controls. Program membership answers none of those, because the customer on that program is a NATO agency and European governments.

Being a sub-tier supplier to a European prime is not the same as selling to the US Department of Defense directly. A Spanish supplier reaches that line with real engineering rigor behind it, and the rigor transfers. The compliance posture does not, because nobody in that chain ever asked you for it.

The build is the same three things for every allied parent, and each has a precise definition you can hold your advisors to.

One milestone moved. On July 13, 2026, the Department suspended the CMMC Phase II requirements scheduled for November 10, 2026 and opened a 60-day review, while Phase I self-assessment requirements remain in place. The announcement was explicit that this does not eliminate the requirement to protect federal data. So a certification milestone moved, and the engineering underneath it did not, because the obligation was never contingent on the certificate. Design the boundary and the controls into the operating model now, and the review lands where it lands without touching your schedule.

New England is the landing zone. My base is Brookline, New Hampshire, and the work is delivered on-site across Greater Boston and Southern New Hampshire, where the primes and the regional supply base already are. I have been the European parent's operator in the United States: I ran the North America operations of GEFRAN, an Italian sensor and automation multinational with a plant in New England, so the friction between a European headquarters and an American floor is familiar ground.

I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome.