Spain-Canada Agreement: What Defense and Technology Companies Must Do

Key data

Spanish defense, aerospace and technology companies have had a new avenue to access the Canadian market since September 2025, but also a new obligation: to adapt their security systems to the standards of the Spain-Canada bilateral agreement on the protection of classified information, signed in Madrid on September 9, 2025 and published in the BOE on May 7, 2026.

This agreement is not just a diplomatic text. It has direct consequences on which companies can bid for defense and intelligence contracts in both countries and which are excluded for failing to meet the required security standards.

What does this regulation establish?

The agreement creates a common legal framework between Spain and Canada to regulate the exchange and protection of classified information between both States. The central elements of the agreement are:

• Equivalent classification levels: The agreement defines what classification level of one country is equivalent to that of the other, allowing information to flow securely between both systems.
• Custody obligations: It establishes the specific responsibilities that both public bodies and private companies must assume in the management of classified information received from the other country.
• Responsibilities in case of compromise: It regulates what happens and who is responsible if classified information is compromised, leaked or accessed without authorization.
• Access to classified contracts: Companies that meet the standards of the agreement will be able to participate in tenders and contracts involving sensitive information within the framework of bilateral cooperation.

The agreement especially facilitates cooperation in joint defense and intelligence projects, potentially opening the Canadian market for Spanish companies and vice versa.

Economic and operational impact

The impact of this agreement has two sides: one of opportunity and one of adaptation cost.

On the opportunity side, Spanish defense and technology sector companies that meet the requirements will be able to access tenders and contracts in Canada that were previously unavailable or more difficult to obtain. Cooperation in joint defense and intelligence projects significantly expands the potential market.

On the cost side, adapting to the security standards required by the agreement involves investment in:

• Review and updating of classified information management systems.
• Training of personnel with access to sensitive information.
• Implementation of custody protocols aligned with the classification levels defined in the agreement.
• Establishment of response procedures for possible compromises of classified information.

Companies that do not carry out this adaptation will be excluded from tenders and contracts involving classified information within the framework of this bilateral cooperation, which represents a direct loss of business opportunities in the Canadian market.

Who does it affect?

The agreement has direct impact on the following actors:

• Defense sector companies that participate or want to participate in contracts with classified components in Spain or Canada.
• Aerospace sector companies with projects involving sensitive or classified information within the framework of bilateral cooperation.
• Technology companies that provide services or develop solutions for defense or intelligence bodies of both countries.
• Armed forces and intelligence services of Spain and Canada, as main actors in the exchange of classified information.
• Public bodies that manage joint defense or security projects with the other country.

If your company works in any of these sectors and has or seeks commercial relationships with Canada in the field of defense or security technology, this agreement directly affects you.

Practical example

A Spanish secure communications technology company wants to participate in a joint Spain-Canada tender for the development of encrypted communication systems for military use.

To be able to access that tender, the company will need to handle classified information from both countries. With the agreement in force, it will need to demonstrate that its security systems comply with the standards defined in the bilateral framework: recognized equivalent classification levels, documented custody protocols and clear procedures for responding to possible compromises of information.

Without that adaptation, the company will be excluded from the bidding process, regardless of its technical capacity. With it, it gains access to a market of defense and intelligence contracts that was previously closed to it or much more difficult to reach.

What should companies do now?

1. Assess whether your company falls within the scope of application: If you operate in defense, aerospace or security technology and have or seek contracts with classified components in Spain or Canada, this agreement affects you.
2. Audit your current classified information management systems: Compare your current protocols with the security standards required by the agreement to identify gaps.
3. Adapt internal classification levels: Ensure that your company understands and can manage the equivalent classification levels defined in the Spain-Canada bilateral agreement.
4. Establish or update custody protocols: Clearly define who has access to what information, how it is stored and how it is transmitted securely.
5. Define the response procedure for information compromises: The agreement establishes responsibilities in case classified information is compromised. Your company must have a documented protocol.
6. Train personnel with access to sensitive information: Technical adaptation is not enough if staff do not know the obligations imposed by the agreement.
7. Consult with a specialist in information security and defense public procurement: Proper authorization to handle classified information requires specialized advice.