This article appears in our 2026 Defence Outlook guide, which explores the key trends shaping Canada’s aerospace and defence sectors. Read the full outlook and download our guide here.

As geopolitical tensions continue to shape global trade and security dynamics, export controls remain a critical area of compliance for Canada’s aerospace and defence industries. In our Defence Forecast 2025, we reviewed key changes in the regulatory environment proposed in Global Affairs Canada’s (GAC) Forward Regulatory Plan 2025–2027. Since then, Canada has moved forward with implementing expanded autonomous and multilateral export controls in areas of strategic importance and national security concern, including aerospace and defence.

The recent changes, summarized in this article, expand the scope of the goods and technology subject to export permit requirements. Further, guidance recently published by GAC also reflects increased scrutiny by regulators on intangible transfers of technical data, including a particular focus on exports via cloud-based services.

As the export control regime continues to evolve, it is important for organizations in the aerospace and defence sectors to conduct regular reviews of applicable export controls and permit requirements to ensure they have in place a tailored and up-to-date Canadian export compliance program, including in respect of sensitive technical data.

New controls on strategic goods and technology

The Export Control List (“ECL”), maintained by GAC, is periodically revised to reflect new security concerns, emerging threats, and international treaty obligations. Beginning in mid‑2024, Canada began phasing in tighter controls on select “strategic” technologies. The expansion initially focused on quantum computing and advanced semiconductors, and then expanded in 2025 to capture equipment, materials, and processes related to manufacturing those and other advanced systems.

The major updates to the ECL were primarily implemented through the creation and then expansion of a new category of the ECL: Group 5, Item 5506 – Other Strategic Goods and Technology (“Item 5506”). The new controls under Item 5506 came into force on July 20, 2024, and April 25, 2025. Goods and technology controlled under this heading are controlled for export to all destinations other than the United States.

What is controlled under Item 5506 includes a number of goods and technology vital to the development, production, and deployment of advanced aerospace and defence systems—especially in sectors such as propulsion, thermal protection, and avionics. They include:

  • Enabling hardware for advanced quantum computing systems: controls on specified quantum computers, cryogenic Complementary Metal Oxide Semiconductor (CMOS) devices, quantum‑limited parametric signal amplifiers, high‑performance cryogenic cooling systems, cryogenic wafer probing equipment, and raw ingredients used in the production of qubits, including isotopically enriched silicon/germanium.
  • Technology and equipment for advanced semiconductor manufacturing: controls on Gate-All-Around Field-Effect Transistor (GAAFET) technology, and on Extreme Ultraviolet (EUV) lithography inputs such as masks, reticles, and pellicles.
  • Metal additive manufacturing equipment: controls on certain advanced 3D printing equipment designed to produce metal parts, and meeting a specific set of advanced metrics (i.e. laser, electron beam or electric arc consolidation source, a controlled process atmosphere, in-process monitoring equipment like a coaxial imaging camera, and a closed-loop control system).
  • Technology for the development of high-temperature coatings: controls on high‑temperature coating technology with potential applications in gas turbine engines and missile structures, designed to protect ceramic matrix composites. 

In May 2025, Canada finalized the latest amendment to “A Guide to Canada’s Export Control List” (the “Guide”), incorporating both of these expanded unilateral export control measures, and Canada’s latest commitments in the various multilateral export control regimes in which it participates. The new version of the Guide came into force on June 30, 2025.

In addition to the new controls in Item 5506, the 2025 updates to the Guide also included additional controls on certain equipment and material for ultrasonic atomization, and sub-orbital craft designed for military use. In March 2025, the Automatic Firearms Country Control List, listing the countries to which it is authorized to export prohibited firearms, weapons, and devices from Canada, was also updated to add two additional countries—Brazil and Montenegro.

Cloud and data handling: Updated guidance

Canada’s export controls are not limited to governing only physical shipments of goods. Critically, an “export” includes transfers or disclosures of controlled technology outside Canada, including by email, screen share, cloud access, or other remote means.

GAC recently issued updated guidance in late 2025 on the movement and storage of controlled technology in the cloud, which may result in storage of data on servers located in a number of foreign jurisdictions. Key takeaways from the guidance, which are relevant to any organization making use of cloud services to store or transfer controlled technical data, include that:

  • Controlled technology stored in the cloud will be considered to have been transferred outside Canada, and therefore an export permit is required, if there is more than a remote possibility that the controlled technology may be examined by a person outside of Canada in a usable form. Evidence of access or certainty of access is not required. This includes the following situations:

    • Persons outside Canada hold data decryption keys or otherwise have access rights in a way that creates more than a remote possibility of access.
    • Technology is transferred abroad without sufficient safeguards to prevent unauthorized access (i.e. inadequate encryption or access restrictions).
    • Exceptions from applicable controls exist in disaster or recovery scenarios that permit the creation of copies of cloud servers that are not subject to the same necessary access restrictions.

  • Technology owners (e.g., companies or researchers) and Cloud Service Providers (CSPs) share responsibility for preventing unauthorized foreign disclosure, and can adopt security practices to make the likelihood of disclosure remote such that no export permit is required.
  • The appropriate applicant for an export permit related to a cloud transfer depends on the particular transaction. However, in general, the appropriate applicant is the person or organization who is responsible for the transfer that is the subject of the application. It is expected that in most cases this would be the cloud service user and not the CSP.

Best practices for export compliance

Given the evolving regulatory landscape and the expanding scope of export controls, organizations in the aerospace and defence sectors should consider the following best practices to maintain robust compliance programs:

  • Export control classification should be evaluated with regard to the newest version of the Guide and be reviewed early in any project’s lifecycle.
  • In performing export control assessments, organizations should be vigilant about technical triggers, as even small details such as wafer diameter, temperature capability, or sensor configuration can determine whether a permit is required to export relevant goods or technology.
  • Access controls and other safeguards, such as industry-standard encryption, should be implemented and enforced for shared drives, design software, and manufacturing toolchains to prevent inadvertent intangible exports.
  • Training is critical in cross-border teams, and all parties involved must understand relevant export control obligations.
  • Records should be maintained of all export control assessments and permit applications to ensure ongoing compliance can be demonstrated.