Luxembourg already knew how to procure military equipment. It knew how to control its export. It is now granting itself the right to manufacture such equipment. The draft bill published on Friday 31 July establishes, for the first time, a framework specifically dedicated to the manufacture of defence-related products. The term brings to mind assembly lines, ammunition and armoured vehicles. The bill goes much further than that. It also covers military satellites, electronic equipment, software, technologies, component integration, testing, repair and even destruction.
This change is not merely regulatory. It complements the Defence Industry Strategy presented on 26 March by the Minister for the Economy, 
The explanatory memorandum states this quite plainly. In light of Russia’s war against Ukraine and the strengthening of NATO’s and the European Union’s capabilities, Luxembourg intends to develop its own defence industrial and technological base. Current legislation regulates civilian weapons, exports, imports and transfers. According to the government, it does not provide a sustainable framework for a defence industry that is set to grow.
Approval from the Minister
Any company wishing to manufacture a product included on the European Union’s Common Military List must obtain authorisation from the Minister for the Economy. This European list comprises 22 categories. It includes weapons and ammunition, as well as vehicles, ships, aircraft, spacecraft, electronic equipment, fire-control systems, software and military technologies.
The authorisation will specify the manufacturer, its director, its production site and the products it is authorised to manufacture. It will be granted for a maximum of five years and will be renewable thereafter. An authorisation will therefore not permit the production of any type of military equipment without restriction. It may be limited to a specific activity, site and product family.
The scrutiny will extend to the company’s share capital. The applicant will be required to disclose the identities of its directors, the members of its governing bodies, its shareholders or partners, and its beneficial owners. The text does not specify any minimum shareholding threshold. Taken literally, it could oblige a company to identify all its shareholders, including the smallest ones.
The government will also carry out a background check on them. It will be able to consult criminal records in Luxembourg and abroad, as well as review ongoing criminal proceedings, police reports and statements relating to incidents dating back up to ten years. An application may remain on hold until a preliminary enquiry or preparatory investigation has been completed.
A glimpse into national security
A second filter will relate to national security. The manufacturer’s activities, ownership or control must not pose, even potentially, a threat to Luxembourg. The draft cites espionage, interference, terrorism, proliferation, organised crime, cyber threats and attacks on the country’s scientific, technical or economic potential.
This provision will give the Minister broad powers to scrutinise the entry of a foreign investor into a Luxembourg-based defence company. However, the text does not specify which authority will carry out this security assessment, nor how it will fit in with Luxembourg’s mechanism for screening foreign direct investment.
The Minister will have 60 working days to reach a decision once the application is complete. He may extend this period once, by a maximum of 30 days. Once this period has elapsed, his failure to respond will be deemed to constitute approval.
This tacit authorisation is one of the most sensitive aspects of the bill. It means that, in the absence of an administrative decision, a company could acquire the right to manufacture military technologies. The rule will also apply to renewals. It could be subject to debate during the legislative process, particularly where the assessment of shareholdings or security risks depends on information from abroad.
The premises will be subject to specific standards. They must be fitted with an alarm, a surveillance and access control system, doors and locks capable of withstanding forced entry, reinforced glazing and, in some cases, shutters or barriers to prevent anyone from gaining access.
Few rules on ‘new’ weapons or technologies
These provisions appear to have been designed for weapons or physical components. Their application to organisations developing military software, source code, cloud environments or space technologies is less clear. At the same time, the draft does not impose any explicit rules regarding encryption, IT segregation, cybersecurity during development or incident reporting.
Each manufacturer must ensure the traceability of products by means of a serial number, a batch number or an equivalent system. A register must record their origin, processing, destination, incorporation, export or destruction. It must also specify their quantity and value.
This register shall be kept for the entire duration of the business’s operations. Upon the closure of the business, it must be handed over to the Minister. Customs authorities shall be entitled to access it and examine the correspondence, documents and supporting evidence necessary for the purposes of inspection.
Once again, the text does not distinguish between physical objects and intangible assets. A serial number is suitable for a mechanical part. It is more difficult to apply to an algorithm, a numerical model, an industrial design or a software library. At this stage, the draft merely provides for ‘any appropriate means’.
Public bodies engaged in research and development are, however, excluded from the definition of a manufacturer. They will therefore not be required to obtain this authorisation. The exemption does not explicitly extend to private research companies, spin-offs from a public body or public-private partnerships. The text does not specify further which safety and traceability regime will apply to the exempted public bodies.
Stricter sanctions
Penalties can include up to ten years’ imprisonment and a fine of €1.5m for manufacturing without authorisation or in relation to a prohibited product. Failure to keep a register, non-compliance with safety regulations or certain omissions in reporting may be punishable by three to five years’ imprisonment and a fine of up to €250,000. An attempt to commit such an offence will be punished in the same way as the completed offence.
The bill will also amend the rules governing military brokering. To become a broker in defence-related products, an individual will be required to have held the new manufacturer’s licence for more than five years. Luxembourg will thus retain the experience requirement already set out in the 2018 Act, but will replace its legal basis.
Companies that are already manufacturing in Luxembourg will be granted provisional authorisation for twelve months following the law’s entry into force. They must use this period to declare their directors and owners, demonstrate their good standing and bring their premises into compliance. The draft legislation thus implicitly recognises the existence of military manufacturing activity even before the creation of its new legal status, without specifying how many companies will be affected.
