Ukraine’s Security of Information Agreements

Reference Updated October 31, 2026 Author: Anna Tsirat Download PDF

When a foreign partner, licensee or investor needs access to classified Ukrainian technology, Ukrainian law allows it only in exceptional cases: under an international treaty to which the Verkhovna Rada has given its consent, or by written order of the President (Article 27(7) of the Law of Ukraine on State Secrets). The same rule governs transfers of classified information to a foreign state (Article 32). The treaties in question are security of information agreements, called in Ukrainian law agreements on the mutual protection of restricted information.

Ukraine has them with NATO, the EU and 47 states (as of October 2026). This page collects them in one place and shows what matters to counsel structuring a transaction: whether an agreement covers contracts with industry, how visits are arranged and how much lead time they need. A consolidated list is also available on the website of the Security Service of Ukraine (SBU), the competent authority on the Ukrainian side.

Elsewhere these instruments go by other names: a General Security of Information Agreement (GSOIA) or Security of Information Agreement (SOIA) in US and NATO practice, often supplemented by an Industrial Security Annex covering contractors. Ukraine’s 2024 security agreement with Belgium itself uses the term GSOIA for the agreement the parties intend to conclude.

Before relying on an agreement

• Ratification is required, and almost every agreement has it, even though most were concluded by governments rather than by states.
• Not every “security agreement” qualifies. The bilateral security agreements Ukraine signed with partner states in 2024 record, on classified information, at most an intention to conclude a separate agreement, and in some cases only an undertaking to explore one. In our view, memoranda between ministries and arrangements between security authorities are not, on their own, a basis for access by foreigners either.
• Access is arranged between states, not companies. Your client and its staff need clearances from their own state, the security requirements are written into the contract, and each visit involving access is approved in advance by the security authorities of both states. Visit requests are due 10 to 30 days ahead (business days under some agreements), and many agreements allow lists of recurring visitors.
• The agreements are not uniform. Several older agreements have no separate article on contracts with industry. Under the agreement with Japan, visits involving access are foreseen only for officials of government bodies, and contractors receive information through their own government. In our view, agreements without a contracts article are a weaker basis for an industrial joint venture, and the agreement with Japan does not provide for direct access by a Japanese company’s engineers.
• No agreement guarantees access. None obliges a state to share information, and information received may be passed to third parties only with the written consent of the state that provided it. In our view, this means that your client’s affiliate in a third country does not obtain access automatically.
• Where there is no agreement, access requires a written order of the President. In our view, this currently applies to Denmark, despite the scale of Danish–Ukrainian co-production.
• An agreement is not an export licence. Transferring military or dual-use goods, technology or services to a foreign partner requires a separate permit from the State Export Control Service under the Law on State Control over International Transfers of Military and Dual-Use Goods, whether or not a security of information agreement is in place. The agreement governs how information is protected, not whether it may be transferred.

NATO, the EU, EU and NATO member states and other partners

“Contracts with industry” gives the article governing contracts with companies. “Visits” gives the article on visits and, where the agreement sets one, the lead time for a visit request. Article numbers refer to the Ukrainian texts of the agreements. For the agreements of recent years, the “Ratification” column also gives the date of entry into force, taken from the partner state’s official publication: the gap between ratification and the exchange of notifications has ranged from five weeks to more than a year and a half.

• NATO
• European Union
• Albania
• Bulgaria
• Canada
• Croatia
• Cyprus
• Czech Republic
• Estonia
• Finland
• France
• Germany
• Greece
• Hungary
• Italy
• Japan
• Korea, Republic of
• Latvia
• Lithuania
• Netherlands
• North Macedonia
• Norway
• Poland
• Portugal
• Romania
• Slovakia
• Slovenia
• Spain
• Sweden
• Turkey
• United Kingdom
• United States

Other states

States with no agreement in force

As of the date of this update, we have found no published agreement in force with the following states:

How we can help

We act as Ukrainian counsel alongside the client’s lead firm in structuring access to classified Ukrainian technology, from identifying the applicable agreement to the security terms of the contract and the approvals. See our pages on dual-use technologies and export control and defense technology and military procurement. How this plays out in practice is discussed in our note on joint ventures with Ukrainian defense companies.

If you know of an agreement that is not yet listed, let us know and we will update the page.

Related materials

• Who Owns Ukrainian Defense Technology? A Buyer’s Guide to Chain of Title — who holds the rights to a state-funded development and what the new IP policy for the defense industry changes
• Building Ukrainian Military Technology Abroad: Which Door Is Actually Open? — the legal routes for producing Ukrainian military technology outside Ukraine
• Dual-use technologies and export control
• Defense technology and military procurement

This page is not legal advice. Information as of October 31, 2026; sources are the texts of the agreements and the ratification laws in Ukraine’s official legislation databases.