Digital presence in the defence industry: what applies, and what it has to withstand.

The EU dual-use regulation explicitly counts as an export the electronic transmission of technology to a destination outside the EU, and making it available in electronic form to people outside the EU. A downloadable PDF is exactly that.

In its guidance on technology transfer, Germany's export authority BAFA says that information anyone can view online without registering counts as generally accessible. In the same paragraph it also says:

So the exemption for public information protects what is lawfully public. It does not make the first upload of listed technology lawful. Every technical document needs to be classified before it goes online, not after.

Registration alone changes nothing: according to BAFA, information stays generally accessible as long as anyone can in principle register. It is different when you approve each account yourself. BAFA treats information made available only after an individual decision as not generally accessible.

A dealer area where you vet every account is therefore not a public space. Making listed technical documents available there to a dealer in a third country can require a licence. And for making something available, BAFA says what counts is not where the server is, but where the person who grants the access is.

Austria's Foreign Trade Act 2011 says the same: technology is technical knowledge that is not generally accessible, and making it available electronically to people in third countries is an export. If your product contains US technology, ITAR applies too. There, information becomes public domain only through eight defined routes, such as trade shows in the United States or approval by a US agency. Your own website is not one of them.

This is our reading of the texts, not legal advice. Have your export control officer or a law firm check how your documents are classified.

Germany's implementing act was promulgated on 5 December 2025. On its page for affected companies, the BSI states that the statutory registration deadline has passed. In Austria, the NISG 2026 has applied since 1 October 2026.

It covers medium-sized and large companies in the listed sectors, including the manufacture of computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment. Only public administration in defence is excluded. In Germany, a private company can be exempted case by case, and only for the activities concerned.

One duty matters most to suppliers: Article 21 requires every covered company to manage supply chain security, including its relationships with its direct suppliers. That is why the questionnaire arrives. Your customer has to vet you even if you are not covered yourself.

MBDA Deutschland publishes rules for suppliers who work with MBDA data. They apply to subcontractors too. For data classified IN STRICT CONFIDENCE they say:

Companies handling restricted material (VS-NfD) had to complete self-accreditation by 1 September 2025. Networked systems must follow the BSI's IT-Grundschutz, and virus scanning may not happen outside the restricted network, for example in the cloud.

For the website that means a clear separation: the contact form, the download area and the dealer portal are not how classified documents travel. Whatever the customer sends belongs in the system the customer prescribes for it.

The US CLOUD Act obliges providers to disclose data in their possession, custody or control, regardless of whether it is stored inside or outside the United States. Before the French Senate, Microsoft France was asked whether French citizens' data would never be handed over on a US government order. The answer:

The Bundeswehr answers the question for itself by isolation: from 2026 its IT provider BWI is building an air-gapped Google cloud in its own data centres for data up to VS-NfD, which according to the Bundeswehr not even Google Cloud itself can access. Airbus is tendering for a sovereign European cloud because part of its information is extremely sensitive. In April 2026 the BSI published its own criteria for the sovereignty of cloud services.

So when your customer asks where your website and portal run, they are not asking about the data centre. They are asking who can force the operator to hand data over.

According to Germany's federal police (BKA), the pro-Russian group NoName057(16) has run 14 attack waves in Germany since November 2023 against about 250 companies and institutions, defence firms among them. In Austria such overload attacks hit more than 40 organisations before the 2024 general election. The EU cybersecurity agency ENISA counts overload attacks as 77% of recorded incidents; the most common way into a company's network is phishing, at about 60%.

North Korea's Lazarus group attacked three European defence companies, drone makers among them, with fake job offers. In July 2026 Germany's domestic intelligence service warned the sector of an increased likelihood of espionage and sabotage by Russian state bodies.

So your website will be attacked even though nothing secret is on it. It has to stay reachable when that happens. And the careers page is a way in: naming a recruiting contact and saying how you never recruit takes the game away from fake recruiters.

Enforce Tac in Nuremberg had more than 1,400 exhibitors from 45 countries and about 26,500 trade visitors in 2026; only armed forces, authorities and security organisations are admitted. Eurosatory in Paris drew more than 2,600 exhibitors from 68 countries in 2026, over 200 of them from Germany.

After the fair, people look you up. In a survey of 1,200 European engineers, 86% named data sheets as a supplier's most valuable content, far ahead of technical articles. So the data sheet on the website has to say the same as the one on the stand, in the same version.

LinkedIn prohibits ads related to the promotion, use or sale of weapons, ammunition or any other violent product, with no exception for B2B or government buyers. Google Ads bans guns, gun parts and explosives as well.

For much of the sector, paid reach is closed. The visit to your website comes from a fair, a referral or something someone passed on. What they find there has to pass the check that follows.

• Every technical document classified before it goes online: open, by approval only, or not online at all.
• A protected area where each access is approved individually, checked by country and logged, as in the defence and government access module.
• Hosting with a provider that has no US parent, and a list of every subprocessor you can attach to the questionnaire.
• One version of each data sheet, from one source, on the website and on the stand.
• A website that survives an overload attack, and forms that no classified document passes through.
• A careers page with a named contact and a note on how you never recruit.

1. List every document that is online today: data sheets, manuals, drawings, presentations.
2. Have export control classify each one. Anything listed comes offline until it is clear who may see it.
3. Check whether your company falls under NIS2 or the NISG 2026, and prepare your answers to the supply-chain questionnaire.
4. Check hosting, e-mail and forms for providers owned by a US parent.
5. Build the protected area so that every approval is individual and traceable.
6. Put website, catalogue and trade fair on the same product data.