UK companies working with US defence technology must comply with the International Traffic in Arms Regulations (ITAR), even when operating entirely in the UK. ITAR is US law that follows US-origin defence articles globally.

When ITAR applies to UK companies

Receiving technical data from US defence companies
Manufacturing items containing US-origin defence components
Collaborating on US defence programmes
Exporting items derived from US defence technology

ITAR Compliance for UK Companies

US ITAR requirements for UK aerospace and defence companies handling US defence articles

US regulator: Department of State - Directorate of Defense Trade Controls (DDTC)
Legislation: International Traffic in Arms Regulations (ITAR) - 22 CFR 120-130
UK company obligations: Any UK company handling ITAR-controlled defence articles must comply with US regulations
DDTC registration requirement: Annual registration required if manufacturing, exporting, or brokering ITAR items
Annual registration fee: USD $3,000-4,000 per year (tiered structure, ~£2,400-3,200)
Technical Assistance Agreement (TAA): Required for US company to share ITAR technical data with UK company
TAA processing time: 60-180 days for DDTC review and approval
Manufacturing License Agreement (MLA): Required for UK company to manufacture ITAR-controlled items under US license
MLA processing time: 90-180 days, can extend to 12+ months for complex cases
Criminal penalty: Up to USD $1 million per violation and 20 years imprisonment
Civil penalty: Up to USD $500,000 per violation
Record keeping: Maintain ITAR records for 5 years

Critical compliance requirements

ITAR requires strict controls on who can access controlled technical data. UK companies must implement comprehensive security measures and maintain detailed records.

Critical ITAR Requirements for UK Companies

Essential compliance requirements UK companies must follow when handling ITAR-controlled defence articles or technical data.

Foreign Person Access Restriction: ITAR technical data cannot be shared with non-UK/non-US nationals without additional DDTC authorisation
Physical Security: ITAR data must be stored securely with access controls, locked facilities, and encryption for electronic data
Re-export Prohibition: UK companies cannot re-export ITAR items or share technical data with third countries without DDTC approval
Record Keeping Requirement: Maintain records for 5 years documenting who accessed ITAR data, when, and for what purpose
Annual Reporting (if required): Some TAAs and MLAs require annual reports to DDTC on manufacturing volumes, sales, or technology transfer activities
Security Plan Requirement: Document ITAR compliance procedures and train all staff with access to ITAR data on their obligations
Data Encryption: ITAR technical data in transit must be encrypted (email encryption, secure file transfer)
Visitor Controls: Non-US/non-UK visitors to facilities handling ITAR data must be escorted and prevented from viewing ITAR materials

Obtaining a Technical Assistance Agreement (TAA)

Before a US company can share ITAR-controlled technical data with your UK company, you need a Technical Assistance Agreement approved by the US State Department's Directorate of Defense Trade Controls (DDTC).

How to Obtain a Technical Assistance Agreement (TAA)

Step-by-step process for UK companies to obtain a TAA for receiving ITAR-controlled technical data from US companies.

Step 1 - Determine ITAR applicability: Check if the technology or goods are listed on the US Munitions List (USML) Categories I-XXI. If so, ITAR applies and a TAA is required for technical data transfer.
Step 2 - US exporter registers with DDTC: The US company providing the technical data must be registered with DDTC as an ITAR exporter. Registration costs USD $2,750 annually.
Step 3 - UK company due diligence: The US exporter will conduct end-user screening to ensure your UK company is not on the DDTC Debarred List or other US denied parties lists.
Step 4 - Draft Technical Assistance Agreement: Prepare a TAA specifying what ITAR technical data will be shared, the UK end-use, security measures, and restrictions on re-export or sharing with third parties.
Step 5 - Submit TAA to DDTC: The US exporter submits the TAA via the D-Trade online portal. DDTC reviews the agreement for 60-180 days depending on complexity and sensitivity.
Step 6 - Congressional notification (if required): For agreements valued over $500 million, DDTC must notify Congress. This adds a 30-day waiting period before approval can be granted.
Step 7 - DDTC approval and conditions: If approved, DDTC issues the TAA with specific conditions including security requirements, reporting obligations, and restrictions on foreign person access.
Step 8 - UK company compliance: Implement ITAR-compliant security measures (physical security, access controls, encryption). Do not re-export or share ITAR data with third countries without DDTC approval. Maintain access records for 5 years.
Step 9 - TAA amendments and renewals: Any changes to the TAA (scope, parties, technical data) require DDTC approval via amendment (USD $250-1,000 fee, 30-90 days processing). TAAs must be renewed if they have expiration dates.

AUKUS defence trade exemption (ITAR § 126.7)

From 30 December 2025, UK companies that register as Authorized Users in the US Defense Export Control and Compliance System (DECCS) can trade most ITAR-controlled items with the US and Australia without individual DDTC licences. Over 700 Australian and UK entities have already been approved.

To use this exemption, your company must:

Register through the UK government's national-level enrolment process
Be approved as an Authorized User in DECCS
Ensure all transfers remain within the physical territory of the UK, US, or Australia
Meet the specified conditions for the exemption category

This is a significant simplification for UK defence companies that previously needed individual TAAs or MLAs for routine US defence cooperation.

US regulator

Department of State, Directorate of Defense Trade Controls (DDTC)

DDTC annual registration (Tier 1)

USD $3,000 per year ($2,500 for eligible small businesses)

DDTC annual registration (Tier 3)

USD $4,000 plus $1,100 for each approval over 5 approvals

TAA processing time

60 to 180 days for DDTC review

MLA processing time

90 to 180 days, up to 12 months for complex cases

Criminal penalty (US)

Up to USD $1 million per violation and 20 years imprisonment

Civil penalty (US)

Up to USD $500,000 per violation

Record keeping

Maintain ITAR records for at least 5 years

AUKUS exemption (from 30 December 2025)

UK Authorized Users can trade most ITAR items with the US and Australia without individual licences

1

Determine if ITAR applies to your work

Check if the technology or goods you handle appear on the US Munitions List (USML Categories I–XXI). ITAR applies if you receive, manufacture, broker, or export any US-origin defence articles.
2

Check if you qualify for the AUKUS § 126.7 exemption

UK companies can register as Authorized Users through the UK government enrolment process. If approved, most ITAR transfers between the UK, US, and Australia do not need individual licences.
3

Register with DDTC if required

If you manufacture, export, or broker ITAR items and the AUKUS exemption does not cover your activity, register annually with DDTC via D-Trade. Fees start at USD $3,000 per year.
4

Obtain a TAA or MLA where needed

If the AUKUS exemption does not cover your transfer, the US company sharing ITAR data must submit a TAA to DDTC. Allow 60 to 180 days for processing.
5

Implement ITAR security controls

Restrict access to ITAR data to approved UK and US nationals only. Use encrypted storage and transmission. Maintain access logs for at least 5 years.
6

Train staff on ITAR obligations

All employees with access to ITAR data must understand restrictions on sharing, re-exporting, and foreign person access. Document training records.

ITAR compliance resources

Use these resources to understand your ITAR obligations and register with US authorities.

DDTC Public Portal (opens in a new tab)
US Directorate of Defense Trade Controls — registration, licences, and the Authorized User enrolment for the AUKUS exemption.
US State Department
AUKUS defence trade exemption (§ 126.7) (opens in a new tab)
Key elements of the AUKUS defence trade exemption effective 30 December 2025.
US State Department
GOV.UK Notice to Exporters on ITAR (opens in a new tab)
UK government guidance on ITAR obligations for UK companies.
GOV.UK
OGEL (AUKUS Nations) (opens in a new tab)
UK Open General Export Licence for AUKUS nations facilitating defence trade with the US and Australia.
GOV.UK

ITAR Compliance for UK Companies

Export Control (Dual-Use Technology)

UK Export Controls for Defence Products

Understanding UK export licensing and controls

Vehicle and transport equipment manufacturer: compliance checklist

Tech Sector Licensing and Authorisations

When ITAR applies to UK companies

Critical compliance requirements

Obtaining a Technical Assistance Agreement (TAA)

AUKUS defence trade exemption (ITAR § 126.7)

Determine if ITAR applies to your work

Check if you qualify for the AUKUS § 126.7 exemption

Register with DDTC if required

Obtain a TAA or MLA where needed

Implement ITAR security controls

Train staff on ITAR obligations

ITAR compliance resources

Related guides in Export Licences

When ITAR applies to UK companies

Critical compliance requirements

Obtaining a Technical Assistance Agreement (TAA)

AUKUS defence trade exemption (ITAR § 126.7)

Determine if ITAR applies to your work

Check if you qualify for the AUKUS § 126.7 exemption

Register with DDTC if required

Obtain a TAA or MLA where needed

Implement ITAR security controls

Train staff on ITAR obligations

ITAR compliance resources