Defence & Dual-Use
NATO DIANA and Ukraine: The MoU Opens the Door, but Does Not Grant Access
NATO DIANA's first memorandum with Ukraine marks a significant step in defence innovation cooperation. But it does not automatically grant Ukrainian companies access to DIANA funding or competitions. We examine the ownership and control requirements, IP rights, export controls and alternative routes through UNITE–Brave NATO.
Complex law. Clear action.
Reviewed by Oleksandr Sobovyi, Founder & CEO of CORVUS AI — editorial responsibility statement below.
On 29 October 2026, NATO and Ukraine took an important step in defence technology cooperation. DIANA signed its first-ever Memorandum of Understanding (MoU) with a NATO partner country. But political commitment to cooperation and the legal right to participate in NATO programmes are two different things.
The MoU establishes a framework for joint development, testing and scaling of technologies. However, the published documents do not confirm that Ukrainian companies have gained the right to apply directly to DIANA competitions or receive funding under those programmes.
More importantly, the existing eligibility rules contain a restriction that is often underestimated: incorporating a company in a NATO member country is not sufficient. The nationality of its owners and the structure of effective control also matter.
For Ukrainian developers and European integrators, the critical questions now concern eligibility, intellectual property, export controls, testing data and the legal structure of joint projects.
1. What NATO and Ukraine Signed
According to NATO's official announcement of 29 October 2026, the MoU was signed at NATO Headquarters in Brussels. It is the first agreement of this kind between the Defence Innovation Accelerator for the North Atlantic (DIANA) and a NATO partner country.
The announced areas of cooperation include:
Joint technology development and testing.
Helping Ukrainian developers understand NATO's technical and organisational requirements.
Exploring access to testing infrastructure.
Addressing barriers to scaling promising technologies.
Strengthening connections between Ukraine's innovation ecosystem and those of NATO member countries.
DIANA confirmed these priorities on 30 October, describing the MoU as the beginning of closer cooperation.
However, the published announcements do not specify funding commitments under the new MoU, the number or value of future contracts, special eligibility arrangements for Ukrainian companies, or automatic access to testing facilities.
The legal distinction between a framework for cooperation and enforceable programme participation rights is fundamental.
The full text of the MoU has not been identified in the public sources reviewed. It is therefore not possible to determine conclusively whether all or any of its provisions create legally binding obligations.
Nevertheless, the published NATO and DIANA announcements do not establish an independent right for Ukrainian companies to participate in the Challenge Programme.
Such eligibility must arise under the applicable programme rules and the conditions of the relevant call. Any entitlement to funding must be established through the corresponding agreement.
2. The Main Barrier: Not Just Incorporation, but Ownership and Control
DIANA's official clarification of 25 June 2026 expressly identifies the requirements applicable to companies seeking to participate.
An applicant must:
Be incorporated in a NATO member country.
Have its headquarters and principal place of business in a NATO member country.
Be majority-owned and controlled by nationals of NATO member countries.
Be legally eligible to enter into government contracts in the relevant jurisdictions.
These are not conditions suggested by external advisers. They are published by DIANA itself and reflected in its official eligibility guidance.
Furthermore, the Terms and Conditions of Bidding for a 2026 competition include express representations concerning majority ownership and control in Sections 4.1.1–4.1.2.
The same document requires each company participating in a consortium application to satisfy the eligibility criteria independently (Section 2.5).
Section 4.1.3 also requires activities relating to the bid to be conducted in NATO member countries. This requirement must be checked against the specific terms of each subsequent competition.
Why a European Subsidiary Does Not Always Solve the Problem
Consider a Ukrainian technology developer that establishes a wholly owned subsidiary in the Netherlands or Poland.
The incorporation requirement is satisfied.
But the majority ownership requirement is not, where the Ukrainian shareholder does not hold the nationality of a NATO member country.
Transferring shares to a nominee shareholder does not necessarily resolve the question of effective control.
Even where the corporate ownership requirements are satisfied, a separate issue remains: does the applicant hold sufficient rights to the technology it proposes to DIANA?
An undocumented licence from a Ukrainian parent company, the absence of authorisation to transfer source code, or restrictions arising from a government contract may create substantial problems during due diligence or subsequent contracting.
CORVUS AI assessment: A European legal entity must be structured around the actual programme requirements and a lawful arrangement for ownership or licensing of the technology. Incorporation alone does not establish eligibility.
Current Terms and Conditions must be reviewed for every new call. Requirements from previous competitions should not automatically be treated as applicable to future ones.
As of 3 November 2026, applications for the principal 2027 DIANA Challenges have already closed. The MoU does not reopen that application process.
3. DIANA and UNITE–Brave NATO: Two Different Mechanisms
The restrictions applicable to the DIANA Challenge Programme do not mean that Ukrainian companies are excluded from all NATO-supported innovation projects.
Two distinct mechanisms must be considered.
DIANA Challenge Programme is directed towards companies meeting its specific requirements regarding incorporation, place of business, ownership and control.
UNITE–Brave NATO is a separate NATO–Ukraine initiative expressly designed to support joint projects involving Ukrainian companies and companies from Allied countries.
According to NATO's official announcement of 25 March 2026, the initial phase of UNITE–Brave NATO provides for €10 million in joint funding, focusing in particular on counter-uncrewed systems and air defence capabilities.
The programme involves the NATO Communications and Information Agency (NCIA) and Ukraine's Brave1 innovation ecosystem. Participation is governed by the programme's own procurement and competition rules.
This distinction has practical consequences.
A Ukrainian company that does not meet DIANA's direct eligibility requirements may consider UNITE–Brave NATO as an alternative route, provided that it satisfies the conditions of the specific procurement and establishes the required partnership structure.
Participation in UNITE–Brave NATO does not, however, confer automatic eligibility for the DIANA Challenge Programme.
For Ukrainian developers, the relevant question is not how to circumvent DIANA's restrictions, but which programme genuinely accommodates the proposed structure of cooperation.
4. Intellectual Property: DIANA's Policy Does Not Replace a Contract
DIANA confirms that innovators retain their intellectual property rights. Within the Challenge Programme, DIANA and other parties involved in the programme do not claim ownership of the innovators' IP.
This is an important safeguard, but its limits must be understood.
Separate joint development, commercial deployment or subsequent procurement arrangements may be governed by different agreements.
DIANA also explains that future usage and licensing rights in separate partnership or procurement relationships are determined by the relevant contractual arrangements.
Consider a Ukrainian company providing an autonomous navigation algorithm to a European integrator, which adapts the algorithm to a new platform and carries out testing.
Before work begins, the parties should agree on:
Background IP: Technologies, algorithms, source code and know-how owned or controlled by each party before the project.
Foreground IP: Ownership and use of intellectual property created during the cooperation.
Improvements: Rights to modifications and enhancements made during integration.
Testing data: Rights to retain, analyse, disclose and commercially exploit testing results.
Follow-on rights: Rights to use jointly developed results in subsequent competitions, procurement procedures and commercial projects.
Particular attention must be given to the chain of title on the Ukrainian side.
Where technology was developed under a government contract, through public institutions or with earmarked public funding, the parties must examine the contractual terms governing ownership, licensing and any restrictions on transfer to foreign partners.
Ownership of a company and the right to dispose of its technology are not the same thing.
There is another relevant detail.
Section 7 of the published 2026 Terms and Conditions provided mechanisms for sharing certain information about applicants and their submissions with other participants in NATO's innovation ecosystem, subject to an opt-out arrangement.
This does not negate the stated confidentiality safeguards. It does, however, demonstrate why applicants must examine not only the IP provisions but also the rules governing information use and disclosure.
5. Testing Data: Commercial Value Does Not Override Security Classification
One of the main strengths of Ukrainian defence technologies is the experience gained through development and deployment under real combat conditions.
But data generated in those circumstances cannot always be freely disclosed to foreign partners.
Depending on its content and legal classification, information may be subject to:
State secrecy requirements.
Restrictions on the disclosure of official information.
Contractual obligations towards government customers.
Trade secret and intellectual property protection.
Personal data protection legislation.
Ukraine's Law on State Secrets No. 3855-XII establishes a specific legal regime for classifying information as a state secret.
Not all information concerning military deployment is automatically classified. The legal status of the specific information must be established.
Equally, the absence of a security marking on an individual file should not be treated as sufficient evidence that it may be disclosed without restriction.
For example, testing telemetry may reveal system performance, electronic warfare parameters, operational methods or other information requiring specific authorisation or protective measures.
Before joint testing begins, the parties must establish:
Which datasets will be transferred.
Who has legal authority to approve their disclosure.
Where the data will be processed and stored.
Which individuals and organisations will have access.
Whether the data may be used for model training, further development or public demonstrations.
A non-disclosure agreement cannot replace an authorisation required under public law.
6. Export Controls: Technology Transfers Do Not Always Involve Physical Shipments
Export controls are often among the most complex legal issues in EU–Ukraine defence technology projects.
On the Ukrainian side, the relevant framework includes Law No. 549-IV on State Control over International Transfers of Military and Dual-Use Goods.
Export controls may apply not only to physical equipment but also to controlled software, technical documentation and technology.
Sending source code by email, granting remote access to controlled technology or exchanging technical data may trigger export control requirements.
However, the need for a particular authorisation does not arise automatically from the fact of international cooperation.
It depends on the classification of the technology, the nature of the transfer, its intended end use, the recipient and any applicable restrictions.
Before transferring controlled materials, the parties must determine:
Whether the item is classified as military equipment or a controlled dual-use item.
Which operation is involved: export, import, temporary export, technical assistance or another form of international transfer.
Whether an authorisation, opinion or other legally prescribed document is required.
Whether specific end-user or end-use restrictions apply.
On the European side, Regulation (EU) 2021/821 governs exports, brokering services, technical assistance, transit and transfers of dual-use items.
Article 2(2)(d) expressly covers electronic transmission of controlled software and technology outside the customs territory of the European Union.
However, bringing technology into the EU does not automatically create an obligation to obtain an EU export authorisation under that Regulation. Any subsequent export or re-export requires a separate assessment.
Military items are subject to the relevant national licensing regimes of EU Member States.
Where US-origin components, software or technology are involved, the potential application of US controls, including the Export Administration Regulations (EAR) or International Traffic in Arms Regulations (ITAR), must also be examined according to the item's classification and jurisdictional nexus.
The practical conclusion is that export control classification must precede the cross-border transfer of technology. A contract signed after the transfer cannot retrospectively cure an earlier regulatory breach.
7. The AI Act: Civilian Applications May Change the Regulatory Regime
Many Ukrainian defence technologies have dual-use potential.
An autonomous navigation system initially developed for defence purposes may later be deployed in logistics, industrial inspection or infrastructure monitoring.
This creates a separate regulatory issue.
Under Article 2(3) of Regulation (EU) 2024/1689 — the AI Act, the exclusion applies insofar as AI systems are placed on the market, put into service or used exclusively for military, defence or national security purposes.
Where a system is subsequently offered or used for civilian purposes within the material and territorial scope of the AI Act, that application requires a separate legal assessment.
This does not automatically make the system high-risk.
Classification depends on the intended purpose, characteristics of the system, Article 6 and the relevant annexes to the AI Act.
The assessment must also take account of amendments introduced by Regulation (EU) 2026/1744, including revised application dates for certain requirements concerning high-risk AI systems.
If testing or civilian deployment involves processing personal data, Regulation (EU) 2016/679 — the GDPR must also be considered where its material and territorial scope is engaged.
CORVUS AI's position: The compliance architecture for dual-use technology should be considered from the development and integration stage.
Entering a civilian market may change the applicable obligations, documentation requirements, allocation of liability and conditions for commercial deployment.
8. Liability for Testing Depends on Applicable Law and Contractual Arrangements
A framework MoU does not replace the legal arrangements required for a specific testing activity.
Before equipment is transferred, software access is granted or testing begins, the parties should establish:
Who operates the system.
Who is responsible for safety at the testing facility.
Who has authority to suspend or terminate testing.
Who bears liability for damage to equipment or third parties.
Which limitations of liability are legally permissible.
What insurance requirements apply.
Which law governs the agreement and how disputes will be resolved.
The legal status of the testing organisation must also be assessed separately.
Private entities, national government institutions and NATO bodies may be subject to different liability regimes.
It would be incorrect to assume that every testing centre automatically benefits from NATO immunities.
Liability must be assessed by reference to the actual participants, applicable law and practical organisation of the testing activities.
9. Three Legal Routes for Ukrainian Developers
Route 1 — Direct Participation in DIANA
This route is available to companies that genuinely satisfy the applicable incorporation, location, ownership and control requirements and possess sufficient rights to the proposed technology.
The current terms of the relevant competition must be examined.
Creating a nominal corporate presence without satisfying the underlying eligibility criteria does not resolve the problem.
Route 2 — A Joint Project under UNITE–Brave NATO
This mechanism is designed to facilitate cooperation between Ukrainian companies and companies from NATO member countries.
Access depends on the applicable procurement rules, partner requirements and permitted contractual structures.
It is a separate mechanism and should not be confused with the DIANA Challenge Programme.
Route 3 — Commercial Technology Partnership
A Ukrainian developer may cooperate with a European integrator, testing centre or manufacturer through a technology licence, joint development agreement or another legally permissible arrangement.
Such cooperation should not be presented as automatically providing access to DIANA.
Its feasibility and conditions depend on the applicable legal framework, contractual arrangements and the rules of any programme involved.
The common requirement across all three routes is demonstrable legal readiness to transfer, test and commercially exploit the technology.
10. What Must Be Done Before a Joint Project Begins
Ukrainian developers should start with four questions.
First — ownership and control. Who ultimately owns and controls the company? Does its structure satisfy the requirements of the selected programme?
Second — chain of title. Who owns the technology? Are there restrictions arising from government contracts, funding arrangements or previous agreements?
Third — export controls and data classification. Which technologies and datasets will be transferred, to whom, by what means and subject to which authorisations?
Fourth — contractual structure. How will intellectual property, testing results, commercial rights, costs and liability be allocated?
European partners must conduct a corresponding assessment.
The technical value of a Ukrainian solution does not, by itself, establish that the technology can lawfully be integrated, tested, licensed or subsequently sold.
The critical objective is to identify legal obstacles before controlled information is exchanged or jointly developed results are created.
Conclusion: The Political Door Is Open, but the Legal Route Still Has to Be Established
The DIANA–Ukraine MoU is significant.
It confirms NATO's interest in closer engagement with Ukraine's innovation ecosystem and provides a framework for new forms of technological cooperation.
But it cannot be interpreted as a general authorisation to participate in DIANA programmes, transfer controlled technologies or exploit the results of joint testing.
For direct participation in the Challenge Programme, the principal obstacle is not simply the country of incorporation. It is also the nationality of the owners, effective control and compliance with the specific eligibility rules.
At the same time, separate mechanisms already exist — particularly UNITE–Brave NATO — that envisage joint projects involving Ukrainian companies and companies from NATO member countries.
The practical question for developers and integrators is therefore different: which programme and contractual structure can be used lawfully while preserving control over the technology and ensuring an acceptable allocation of risk?
The MoU creates a political opportunity. Turning that opportunity into an executable project requires properly structured rights, regulatory authorisations, contracts and partnerships.
Complex law. Clear action.
Disclaimer
This article has been prepared by CORVUS AI for general informational and educational purposes only. It is intended to make complex legal and regulatory developments easier to understand.
It does not constitute legal advice and does not create a professional adviser–client relationship. The information should not be relied upon as a substitute for advice based on the specific facts, circumstances and applicable law relevant to your organisation or project.
The article reflects our understanding of the law and regulatory framework as of the date of publication. Legislation, case law, regulatory guidance and administrative practice may subsequently change. While reasonable care has been taken in preparing this article, CORVUS AI does not warrant that the information is complete or remains current after the date of publication. We do not undertake to update this content.
To the fullest extent permitted by applicable law, CORVUS AI excludes liability for loss arising from reliance on this article. Nothing in this article constitutes an offer or solicitation to provide regulated legal services in any jurisdiction where doing so would be unlawful.
AI-assisted preparation: This article was prepared with the assistance of AI tools. Its legal analysis, conclusions and final text were subject to human review and editorial control and were reviewed and approved prior to publication by Oleksandr Sobovyi, Founder & CEO of CORVUS AI. CORVUS AI retains editorial responsibility for the published content.
For advice tailored to your organisation, project or specific circumstances, please contact CORVUS AI.
About the Author
Oleksandr Sobovyi
Founder of CORVUS AI, a Netherlands-based legal and regulatory advisory practice.
Former Director of the Legal Department of Ukraine's Ministry of Defence and Director of the Department of Legislation on Law Enforcement, National Security and Defence at Ukraine's Ministry of Justice.
CORVUS AI advises on EU law, AI regulation, defence and dual-use technologies, export controls and the legal structuring of EU–Ukraine projects.
CORVUS AI | Netherlands
contact@corvusai.eu
https://corvusai.eu
Editorial Transparency
AI tools were used in preparing this material. Final publication is subject to editorial review and control by CORVUS AI. CORVUS AI assumes editorial responsibility for the approved and published text. Responsible editor: Oleksandr Sobovyi.
Primary Sources and Legal References
NATO and DIANA
NATO — NATO's DIANA and Ukraine strengthen cooperation on defence innovation, 29 October 2026
DIANA — NATO DIANA and Ukraine strengthen their cooperation, 30 October 2026
DIANA — Frequently Asked Questions, including Intellectual Property
NATO — Innovation Support Mechanisms, including UNITE–Brave NATO
European Union Law
Regulation (EU) 2024/1689 — Artificial Intelligence Act, consolidated version
Regulation (EU) 2016/679 — General Data Protection Regulation
Ukrainian Legislation
