The board deck has one new slide. The company has signed a consent agreement with the State Department. The fine is manageable. The next three years are not: an outside monitor, an external audit, a classification review of everything the company has built, and a report to DDTC every six months, all running through the next two funding rounds.

For a prime, that is a line item. For a space startup, it is a second company to run. Most founders read ITAR enforcement as a penalty risk. The 2026 settlements show the bigger cost is what comes after the penalty.

This post breaks down what DDTC actually required this year, why those obligations land hardest on small teams, and what the cheapest version of compliance looks like by comparison.

What a 2026 consent agreement actually requires

Both of this year’s headline settlements came in at $36 million, and in both, half of that was money the company had to spend on itself. In GE Aerospace’s April consent agreement, $18 million was suspended on the condition that it fund approved remedial compliance measures. BAE Systems’ August settlement used the same structure: $18 million suspended, to be spent on improving its compliance program.

The operational terms are where the real weight sits. According to Defense Trade Solutions’ breakdown, GE’s agreement runs 36 months and requires an external Special Compliance Officer for at least 24 months plus at least one independent external audit. BAE’s three-year agreement, as summarized by Volkov Law, went further:

1. A DDTC-approved special compliance officer to monitor and report on compliance.
2. A new automated export compliance system across its operating divisions.
3. A classification review of all hardware, software and services made by its ITAR-regulated divisions.
4. At least one outside compliance audit.
5. Status reports to DDTC every six months.

Neither company was debarred, and both got credit for voluntary disclosure and cooperation. These are the outcomes for companies that did several things right. That is the point worth sitting with.

Why the same terms hit a startup harder

Penalties scale with the size and number of violations. Remediation work scales much less. A monitor still needs to be onboarded, briefed and paid. A full classification review still means going through every BOM line and every technical data package. Six-monthly reporting still needs someone to own it. A smaller fine does not shrink those tasks in proportion.

For a 60-person satellite company, that work falls on the same few engineers and program leads who are trying to hit a launch window. Three things compound it:

1. Funding overlap. A 36-month term spans one or two raises. Every investor will ask about it, and consent agreements are made public by the State Department, so the question will come up whether or not you volunteer it.
2. Ownership changes create their own obligations. GE was also charged for failing to notify DDTC of material registration changes within five business days, as 22 CFR 122.4 requires. Restructuring, M&A and ownership changes are typical triggers, which is exactly what a funding round can bring.
3. Diligence discounts. As we covered in mission assurance data room audits and the valuation discount, acquirers price in compliance records that do not hold up. An open consent agreement is the most visible version of that.

The classification review is the term that should worry space programs most. BAE was required to review the classification of everything its ITAR-regulated divisions make. For a space company whose BOM changes every build, that is not a one-off project. It is the work you should have been doing all along, done under supervision and on a deadline.

The cheap version, done early

Read the root causes in both cases and a pattern appears: these were control failures, not knowledge gaps. GE’s authorization procedures had not been updated in more than ten years. One GE engineer exported an ITAR drawing to a Chinese supplier after picking an EAR license, a classification error no review step caught. BAE’s own disclosures, reported by Global Sanctions, pointed to insufficient written procedures, inexperienced compliance staff and inadequate systems for tracking authorizations.

Every item on a consent agreement’s remediation list is something a startup can do now, for a fraction of the cost:

• Classify every BOM line before integration, under both regimes. Our posts on ITAR over-classification and the space launch exclusion show how often the answer shifts.
• Keep a decision record. Who classified it, when, on what basis, and who signed off.
• Track authorizations as live objects. Provisos, signatories, sublicensees and expiry dates, owned by a named person.
• Write a disclosure procedure before you need it. DDTC credited voluntary disclosure in both 2026 cases, but it reduces the damage. It does not undo it.

Where to start this quarter

Run the consent agreement checklist on yourself. Take BAE’s five remediation terms and ask, honestly, which ones you could pass today without outside help. The gaps are your backlog.

Then ask one question in your next board or investor update: if DDTC asked tomorrow for the classification basis of every ITAR-controlled item on your current build, could your team produce it within a week?

If the answer is no, you are carrying unnecessary regulatory risk. We built Astrolytics specifically to eliminate this blind spot, giving you automated ITAR and EAR classification with Empowered Official sign-off and an immutable audit trail on every BOM line so you can show the basis for every decision before a regulator or investor asks for it. See how we secure your mission architecture at Astrolytics.