The session’s core message was that entering the defence sector is not simply a commercial expansion opportunity for startups, scaleups, dual-use producers, or civilian technology companies; it requires a deliberate governance uplift that can satisfy authorities, investors, boards, customers, and supply-chain partners. The host framed the timing through two German developments: in July, the German government adopted a new startup and scale-up strategy, and since February the Bundeswehr has been able to procure from startups up to 100,000 euros more easily. That creates easier and faster access to a regulated market, but the speakers stressed that mistakes in this area can be critical, so companies need governance systems that build trust with public buyers and counterparties.

Barbara Scheben opened the substantive discussion by explaining what makes the defence sector special from a governance perspective. Companies face a highly regulated environment, including stricter export control and sanctions regimes than in the civilian sector. She named German and international requirements such as the Außenwirtschaftsgesetz, Außenwirtschaftsverordnung, dual-use regulation, the Kriegswaffenkontrollgesetz, and, where there is a U.S. nexus, the Export Administration Regulations and International Traffic in Arms Regulations. She also highlighted operational requirements such as sanctions-list screening, client and end-user identification, and ultimate beneficial owner determination. Beyond sales compliance, she emphasized information protection, security, classification rules affecting products, people, and data, and the potential implications for IT systems and even employees’ private lives depending on classification levels.

The second major argument was that defence-sector participation demands audit readiness and transparency across the full supply chain. Barbara described national and international audits, approvals, and licensing processes, noting that authorities and business partners will want assurance that every supply-chain participant is and remains compliant. Public counterparties may audit price determination, while a tier-one customer may impose NATO obligations and test whether suppliers can evidence compliance. This creates practical work around documentation, retention management, internal transparency, and supply-chain controls, especially when international suppliers, production sites, joint ventures, or additional jurisdictions are involved.

Anja Redenz then translated these risks into a practical starting point: companies must first know their business case. They need to determine whether they sell dual-use products, supply a defence company, or sell directly to the Deutsche Bundeswehr or another defence organization, because different scenarios trigger different regulatory requirements. Her recommended starting point is a risk and relevance analysis to identify applicable current and future requirements and the affected processes. She stressed that this is not a single-function adjustment but a group-wide governance uplift touching sales, procurement, HR, IT, finance, controlling, reporting, and legal structure. Examples included security clearances for employees handling classified technical data, which can take twelve to fourteen months, decisions about whether to create a separate defence entity or unit, controls to prevent classified information from flowing to a holding company, audit-proof pricing where no market price exists, and timely reporting for new stakeholders such as the Bundeswehr and BAAINBw.