Controlled goods in Canada: registration, drawings and Notice 1159

What counts as a controlled good?

The Defence Production Act defines controlled goods as the goods in its schedule (s. 35). Public Services and Procurement Canada (PSPC), which runs the Controlled Goods Program, describes them as goods, components and technical data with military or national security significance (page modified 8 May 2025).

PSPC says they include “blueprints and technical specifications in paper or electronic format”. For a machine shop, that means a drawing or a STEP model can be a controlled good before anyone cuts metal.

The list is partly based on Global Affairs Canada’s Export Control List. PSPC’s Guide to the Schedule to the Defence Production Act (modified 24 September 2025) sets out the items one by one.

Who has to register?

Section 37(1) of the Act says nobody may knowingly examine, possess or transfer a controlled good unless they’re registered or exempt. PSPC counts more than 4,000 registrants. Its registration page (modified 11 March 2026) sets the terms:

• There’s no fee.
• The service standard is 32 business days, and PSPC says processing now takes significantly longer. Applications closest to expiry go first.
• Registration is valid for up to 5 years from approval.
• The designated officials, the authorized individual and every owner of 20% or more of the voting shares are security assessed.

Inside a registered business, the designated official security-assesses each officer, director and employee who needs access (Controlled Goods Regulations, s. 15). Registration extends to the business’s own authorized officers, directors and employees (s. 37(4)). A separate business, such as a subcontract shop, needs its own registration or an exemption.

PSPC’s security plan guideline (modified 8 July 2026) gives the working definitions. To examine is to study something in detail to find its essential features or meaning. Possession includes constructive possession: the power and intention to control a good, directly or through other people.

PSPC’s exemptions page (modified 8 May 2025) lists who’s excluded or exempt; the table above has the detail. One case matters for any business with people abroad: a temporary worker, meaning an officer, director or employee who isn’t a Canadian citizen or permanent resident ordinarily resident in Canada, needs an exemption certificate before access.

Under s. 45, breaking s. 37 carries a fine of up to $2,000,000 and up to 10 years in prison on indictment.

Why is relaying a drawing a transfer?

Section 37(3) defines a transfer as to “dispose of it or disclose its content in any manner”. Section 37(2) bars a registered person from knowingly transferring a controlled good to anyone who isn’t registered or exempt. So a buyer, a platform or a shop that passes a controlled drawing on is making a transfer, and whoever receives it must be registered or exempt first.

Here’s how those definitions read against a drawing’s path to a shop. It’s our reading of the Act and PSPC’s definitions; only the program can rule on a case:

Step	What the rules call it	What it takes
A platform or shop holds the file in its storage	Possession, at least constructive	Registration or an exemption
An estimator reads the drawing to quote it	Examining	A security assessment under a registrant
The file goes to a shop by link, email or download	Transfer	The receiving shop is registered or exempt
The file sits where someone abroad could open it	A possible export under Notice 1159	A permit, or safeguards that keep examination abroad a remote possibility

What does Notice 1159 say about the cloud?

Global Affairs Canada’s Notice to Exporters No. 1159 (modified 5 November 2025) deals with export permits under the Export and Import Permits Act. It applies to all technology on the Export Control List, and it points Controlled Goods Program registrants to PSPC’s cloud guidance as well.

• The test. Storing controlled technology abroad is a transfer when it creates a “reasonable possibility” that someone outside Canada could examine it. The notice puts that bar above a mere possibility and below more likely than not.
• What counts. Original files, and derived data such as metadata, logs and disaster-recovery snapshots.
• Examples of a transfer. Someone outside Canada holds the decryption keys or routine access rights, or the data moves abroad without industry-standard encryption.
• Examples that aren’t. Strong encryption with keys managed so examination abroad stays a remote possibility, and automated processing on a closed system with no human access.
• Access from abroad (question 4). Opening a cloud environment that holds controlled technology from outside Canada, or giving someone abroad the means to, is an export that needs a permit. Having access while travelling, without using it or passing it on, isn’t.
• Keys (question 6). Customer-managed keys stored in Canada cut the risk without removing it. The notice asks for key material “held and protected exclusively in Canada”, under a Canadian resident’s control, with rotation, revocation and access logging.
• Change (question 7). A new cloud provider or new services should trigger a fresh assessment.

PSPC’s cloud guidance (modified 8 May 2025) gives the program’s side. Controlled goods data should sit on servers in Canada, encrypted in transit and at rest, reachable only by people security assessed under s. 15 of the Regulations. Storing it abroad means consulting Global Affairs Canada first. The guidance says nothing about where keys are held, which is why Notice 1159 matters. A CanadaBuys notice of 16 May 2024 adds that registrants should use only cloud providers registered in the program.

What should a buyer or a shop check?

• Is the part controlled? Check it against PSPC’s Guide to the Schedule before the drawing leaves your hands.
• Is the shop registered? Search PSPC’s public directory (modified 8 May 2025), which is updated daily. Some registrants have asked not to be listed, so if a shop doesn’t appear, PSPC says to contact the company directly. Ask for the registration number and its expiry date.
• Where will the files live? In Canada, encrypted, with a cloud provider registered in the program and keys held in Canada.
• Who can reach them? Only security-assessed people, and nobody outside Canada.
• What if something goes wrong? A registrant reports any actual or potential breach to the program within 3 days of finding it (Regulations, s. 10(h)).

Where does ITAR fit?

The schedule to the Defence Production Act (s. 2) also covers US-origin defence articles under the US International Traffic in Arms Regulations (ITAR), and goods made with US-origin ITAR technical data. On the US side, 22 CFR 126.5(d) (last amended 18 September 2026) says a retransfer in Canada to another end user or end use needs the prior approval of the State Department’s Directorate of Defense Trade Controls. The original US exporter obtains or provides that approval on request. So a US-origin ITAR drawing can’t go on to a second Canadian shop until that approval is in hand.

How CanadaFab plans to handle controlled work

This section is a plan and a set of rules. None of it runs today, and CanadaFab isn’t registered in the Controlled Goods Program. The rules we’ve set:

• Its own storage lane in Canada. Controlled files will sit apart from everything else, in Montreal with backup copies in Calgary only, encrypted with keys held in Canada under a Canadian resident’s control.
• Security-assessed people in Canada only. Only staff who live in Canada and have been security assessed under the program will open controlled files.
• No access from outside Canada. Nobody abroad will get any path in, our own administrators included.
• No tools hosted abroad. No tool or AI model hosted outside Canada will read controlled files.
• Registered shops only. A controlled file will go only to a shop registered in the program, with its registration number and expiry on file and checked against PSPC’s directory. We’ll record each release as a transfer: what, when and to whom. US-origin ITAR files also wait for the approval under 126.5(d).
• Job numbers in place of part names. File names, logs and notifications will carry a job number only, with no attachments.

Until the lane exists, please don’t send us controlled drawings, by upload, form or email. We’ll update this page when that changes.

This guide is general information, not legal advice. For a ruling on a specific part or setup, contact the Controlled Goods Program or export counsel.