US Market Entry · Spain · Defense & Aerospace Manufacturers
Spain's parts already reach US forces. The compliant operation is still the build.
Spain is a DFARS qualifying country and a Eurofighter partner nation, and Spanish defense electronics already sell into US forces at the product level. Qualifying status gets your parts a procurement preference, and none of it moves controlled technical data across the Atlantic or waives ITAR, CMMC, or FOCI. To win the DoD work that needs a US-person data boundary, you stand up a compliant US operation, and I build and run it, to a CMMC and ITAR-ready posture, in the New England corridor where the primes already are.
The direct answer
How a Spanish manufacturer enters the US defense market.
A Spanish defense or aerospace manufacturer enters the US defense market by standing up a compliant US operation: a US entity, a US-person data boundary, and a floor that runs to a CMMC Level 2 and ITAR-ready posture from the first day it opens. Spain is a DFARS qualifying country under a current reciprocal defense-procurement agreement, which gives your end products a procurement preference, not an ITAR or CMMC waiver. Being inside a NATO program like Eurofighter is a real credential, and it is not the same as selling to the US DoD directly. The US-person data boundary is what lets your American operation hold controlled technical data, and building it is the work.
Spain runs one of NATO's deep defense-industrial bases, strong across combat aircraft, naval combat systems, aerostructures, and propulsion. Spanish end products already carry a Buy American procurement preference under a current reciprocal defense-procurement agreement, and Spanish capability already reaches US forces at the product level. The procurement door is open. What none of that does is move controlled US technical data across the Atlantic or let a Spanish parent reach the controlled data its US operation would hold. That operating wall is unchanged, and it is the lane.
Spain is a Eurofighter partner nation, and in that program a NATO agency is the single point of contact for the customer. It is a genuine credential that answers none of the questions a US DoD contract clause asks: whether the controlled technical data sits inside a US-person boundary, whether the operation safeguards covered defense information under DFARS 252.204-7012, whether foreign ownership is mitigated. Being inside a European collaboration is not the same as being inside the US defense base, and closing that gap is a build, not a sale.
New England is the landing zone. The prime relationships, the supply base, and the compliance depth are already here. A Spanish parent onshoring into the corridor gets an operator who has run a European parent's US operation before, who builds the ITAR and CMMC posture into the floor from the first day, and who owns the operating outcome while your counsel owns the legal instrument.
Know your work class
Most Spanish sub-tier work lands in one class.
Before anyone quotes a Spanish parent a timeline, you need to know which class of defense work you are chasing. Commercial and dual-use parts need only a US entity and a clean quality system. Classified work needs a facility clearance and FOCI mitigation negotiated with DCSA, which stays with your cleared-facility counsel.
The bulk of sub-tier DoD manufacturing sits between them: controlled technical data, CUI, ITAR-controlled but unclassified. The radar and electronics, aerostructures, and propulsion work Spain is strong in lands squarely in this class once it is specified into a US defense program. That class needs DDTC registration, a US-person data boundary, and CMMC Level 2 built into the workflow, and a foreign-owned US entity can reach it without a facility clearance.
● The class I build and run
That middle class, CUI and ITAR-controlled but unclassified, is the class I build and run. It is where a Spanish parent's US operation lives.
The 90-day operating build
A compliant US floor in one quarter, built for a Spanish parent.
The build runs in parallel, not in sequence, because a prime gate does not wait for you to finish one phase before starting the next. The operating model, the IT and OT environment, and the compliance posture come up together.
Days 1 to 30
Diagnostic and design
Stand up the US operating model on paper and on the floor: the org, the value stream, the SQDIP cadence, and the US-person data boundary your ITAR scope needs. Sort what your qualifying-country preference already carries from what a US operation has to hold.
Days 30 to 60
Stabilize and build
Bring the IT and OT environment to a CMMC and ITAR-ready posture from day one, safeguarding covered defense information to the standard DFARS 252.204-7012 sets. Scope the CUI enclave tight around your controlled design data so the assessment stays sane and the parent's access is governed by design.
Days 60 to 90
Qualify and run
Sequence the readiness evidence against the prime gate you are actually racing, coordinate the FOCI and DDTC steps with your counsel, and hand your team a floor that holds after I step back.
The Spanish lane, answered
Three questions a Spanish supplier asks first.
We already supply a NATO program like Eurofighter. Doesn't that qualify us for US DoD work?
It is a real credential, and it is not the same thing. In the Eurofighter program a NATO agency is the single point of contact for the customer, so you are inside a European collaboration with European governments as the buyer. A US DoD sub-tier contract asks a different set of questions: is the controlled technical data held inside a US-person boundary, is the operation safeguarding covered defense information under DFARS 252.204-7012, is foreign ownership mitigated. Being a trusted NATO-program supplier answers none of those, and the US operation still has to be stood up and run to a posture an assessor will accept.
Spain is a DFARS qualifying country. Isn't that enough to sell to the DoD?
No. Qualifying-country status, under Spain's current reciprocal defense-procurement agreement, gives your end products a procurement preference against Buy American and Balance of Payments restrictions. It is a procurement instrument, and the regulation is silent on technical data, ITAR, CMMC, and FOCI. It does not move controlled data across the border for you and it does not waive the compliance build. The US-person data boundary is what does, and building it is the work.
We manufacture in Spain and never export to the US. Does ITAR even reach our US entity?
Read the regulation's own words: a manufacturer who does not export must still register with DDTC, and registration confers no export rights. So standing up and registering a US entity does not, by itself, give the Spanish parent access to the controlled technical data that entity holds. That is not a loophole to close later, it is exactly why the US-person data boundary is the core of the build. Where ITAR scope lands on your specific parts is a question for export-control counsel, and I build the operation to hold controlled data compliantly whichever way that lands.
What I own
The operations partner, not the law firm.
I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome.