Country Briefs
United Kingdom Market-Entry Brief
AUKUS lowered the licensing barrier, not the bar for a US operation. What ITAR 126.7 covers, where the carve-outs bite, and what a UK manufacturer builds here.
Garrett Partridge · July 16, 2026 · 6 min read · Market-Entry Brief
No. AUKUS did not remove the reason a UK defense manufacturer builds a US operation. The relief people mean is one rule, 22 CFR 126.7, a licensing exemption for certain defense trade among Australia, the United Kingdom, and the United States. It changes whether a transfer needs a State Department license. It does not make your firm a US supplier, and the rule says so itself: it "does not remove other applicable U.S. statutory and regulatory requirements." CMMC 2.0 is a Department of Defense contract requirement, FOCI is a DCSA matter, and domestic-content preference is procurement law. None of the three moved. Work that has to sit inside a US operation still needs one: a US entity, a US-person data boundary, and a CMMC Level 2 and ITAR-ready floor.
What the exemption actually is
Start with the instrument, not the headline. AUKUS Pillar 2 is the advanced-capabilities pillar, a suite of cooperative activities across areas like undersea capabilities, quantum, artificial intelligence, and hypersonics. That is a cooperation program. The licensing relief riding alongside it is a rule, and the rule is where your answers live: ITAR 22 CFR 126.7. DDTC calls it a licensing exemption, one that cuts the time and cost of defense trade among the three countries. The relief is real. It is also gated, and DDTC frames the gates as three questions: where the activity happens, who is involved, and what moves. A fourth limit caps the size.
- Where. The activity has to be to or within the physical territory of Australia, the United Kingdom, or the United States. An engineering team sitting anywhere else is outside it.
- Who. Every transferor, recipient, and broker has to be a DDTC-registered US person, a national-level government body of the three countries, or an Authorized User identified through the DDTC website. That status is enrolled, not inherited by nationality: UK entities start through their own government, and DDTC can suspend or revoke a listing.
- What. The article or service cannot appear on the Excluded Technology List at Supplement No. 2 to Part 126.
- How much. The transfer stays inside the value limits the rule sets, and the exemption does not cover manufacturing significant military equipment abroad.
The rule states its own ceiling, in its own words: the exemption "does not remove other applicable U.S. statutory and regulatory requirements."
Where the carve-outs bite a manufacturer
The Excluded Technology List is the part to read before anyone celebrates. It sits at Supplement No. 2 to Part 126, runs to more than two dozen entries, and names what cannot move under the exemption at all.
Read it as a manufacturer and one row outranks the rest. The list excludes manufacturing know-how tied to a set of named munitions-list categories and the parts used only in those articles, plus design methodology and engineering analysis for certain naval articles.
- Missile Technology Control Regime articles, the ones carrying an MT designation, are excluded across Categories I through XV and XX, with one narrow exception.
- Anti-tamper features developed under a Department of Defense Program Protection Plan, where not already installed in the item they protect, are excluded across Categories I through XX.
- Manufacturing know-how for a set of named categories, and for the parts used only in those articles.
- Named platforms and whole categories. The F-22 and the articles specially designed for it are called out directly. Category XVI is excluded outright. Category XXI is excluded unless the State Department designates an item eligible in a written determination.
Manufacturing know-how is the exact technical data you would move to build the part in America. For a set of named categories, the exemption cited as opening the door leaves it behind.
Three regimes AUKUS never touched
A US defense program asks four questions of a foreign-parented supplier. Section 126.7 answers one, whether you need a license to move this. The other three sit exactly where they sat.
- CMMC 2.0 is a contract requirement, not a license question. It reaches you from the Department of Defense through your contract and lands on whichever operation holds the CUI. No ITAR licensing exemption touches it. American Rheinmetall reached CMMC Level 2 across its US production facilities in April 2026, which is the size of that build even for a large allied parent.
- FOCI is an ownership question, assessed by DCSA. A UK parent is still a foreign parent. The exemption changed nothing about who owns you.
- Domestic content is procurement law. The United Kingdom is a DFARS qualifying country under a reciprocal defense-procurement agreement, which gives your end products a procurement preference against Buy American restrictions. A preference is not an ITAR exemption, a CMMC exemption, or a FOCI clearance, and it does not place a supplier inside driving distance of a prime that wants one.
Qualifying-country status, an ITAR licensing exemption, and a CMMC Level 2 certificate are three instruments solving three different problems. A UK supplier can hold the first two and still lose the work for want of the third.
Still moving, so build rather than bet
Every claim above carries a date, on purpose. Anyone quoting this regime to you without one is quoting a version.
The US side entered the ITAR as an interim final rule published August 20, 2024, then an amending final rule published December 30, 2025. The UK side runs on the same clock: the Export Control Joint Unit first published its open general licence for AUKUS nations in August 2024, then revised or replaced it in March 2025, October 2025, and again in April 2026.
Read the pattern as an operator. Both governments have rewritten their side since 2024, and DDTC can revoke an Authorized User listing. A licensing position sits on a moving rule. An operating posture holds through every revision.
That build is the work I do. I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome, in the New England corridor where the primes already are.
Which of your technical data still needs a license is a question for your export-control counsel. Whether your US operation can hold it compliantly is a question for me.
Frequently asked
Direct answers.
Is the AUKUS ITAR exemption automatic for a UK company?
No. The exemption at 22 CFR 126.7 runs to Authorized Users, not to UK companies generally. UK entities start enrollment through their own government, DDTC adds approved parties to the Authorized User List, and DDTC can suspend or revoke a listing. Your export-control counsel owns that enrollment. I build the US operation that has to work whether or not it comes through.
We make components, not weapons. Does the Excluded Technology List reach us?
Check before you assume it does not. The list runs to more than two dozen entries, and several reach components rather than platforms: Missile Technology Control Regime articles carrying an MT designation, anti-tamper features developed under a Department of Defense Program Protection Plan, and manufacturing know-how tied to named munitions-list categories. Controlled technical data, not the visible product, decides your class of work.
If the exemption covers our transfers, do we still need CMMC?
Yes. CMMC 2.0 is a Department of Defense contract requirement, and an ITAR licensing exemption does not reach it. Section 126.7 addresses whether the State Department requires a license to move a defense article. CMMC addresses whether the operation holding CUI under a DoD contract protects it to the standard the contract demands. A UK firm can be an Authorized User with license-free transfers and still be unable to take the contract, because the CUI has nowhere compliant to live.
Why stand up a US operation if AUKUS is supposed to make trade easier?
Because easier trade and a US footprint solve different problems. The exemption can shorten the licensing path for eligible transfers between eligible parties inside the three countries. It does not make you a US supplier against a domestic-content threshold, clear FOCI, certify you to CMMC Level 2, or put your line inside driving distance of a prime that expects one. When a program needs the work held and built inside a US operation, you build the operation.
Sources
- 1. ITAR 22 CFR 126.7, Exemptions for defense trade and cooperation among Australia, the United Kingdom, and the United States (eCFR, current as of 7/15/2026)
- 2. Supplement No. 2 to Part 126, Excluded Technology List, the articles and services ineligible for the 126.7 exemption (eCFR)
- 3. DDTC, ITAR 126.7 Exemption for Australia and the UK, including the Authorized User List in DECCS
- 4. Congressional Research Service R47599, AUKUS Pillar 2 (Advanced Capabilities): Background and Issues for Congress (2024-05-21)
- 5. UK Export Control Joint Unit, Open general licence (AUKUS nations), published 2024-08-16, last updated 2026-04-08
- 6. DFARS 225.003 Definitions, qualifying countries (acquisition.gov, current as of DFARS Change 5/7/2026)
- 7. American Rheinmetall achieves CMMC Level 2 certification for its US production facilities (2026-04-14)
- 8. DCSA, Foreign Ownership, Control, or Influence (FOCI) and facility-clearance mitigation
- 9. US market entry for UK defense manufacturers, the AUKUS lane
- 10. One Thread, Two Flags: the US-person data boundary for a foreign-parented defense operation
- 11. The US Market-Entry Playbook for Allied Defense Manufacturers
Take this with you
Download the print-ready PDF for the boardroom, or put this in front of an operator directly.