EU and Ukraine Launch Joint Drone Alliance; Pentagon Reviews CMMC

Sovereign national security frameworks are building deep, cross-border corporate partnerships while aggressively clearing bureaucratic red tape for innovative small businesses. On July 17, the European Commission officially launched the EU-Ukraine Drone Alliance during the third EU-Ukraine Defence Industry Forum in Kyiv. Implementing the newly signed "Drone Deal," the alliance brings together 18 founding aerospace firms—nine from EU member states and nine from Ukraine—to set up cross-border joint ventures, accelerating the mass production of next-generation uncrewed aircraft and counter-drone systems. The alliance is part of wider EU efforts to strengthen Europe's defence in this fast-changing area and represents a key deliverable of the Joint Communication "Preserving Peace – Defence Readiness Roadmap 2030" and the February 2026 Action Plan on Drone and Counter Drone Security.

The Drone Deal was announced by European Commission President Ursula von der Leyen during celebrations marking Ukrainian Statehood Day on July 15, following her meeting with President Volodymyr Zelenskyy in Ankara on July 8. Von der Leyen emphasized the strategic rationale: "Ukraine has, in many ways, gone from being a buyer to a net security provider for Europe. That also entails a new way of working together". She noted that Ukraine's practical combat experience with unmanned systems—the country is currently producing 10 million drones per year and envisions this number rising to 20 million annually—should serve as the basis for developing European defense industry capabilities. Von der Leyen explained that "we do not have that battle-tested knowledge and expertise that Ukraine has forged. We need to combine our strengths. Together, we can work on joint production". The agreement will combine Ukrainian ingenuity with Europe's industrial scale and send a clear signal that "now is the time to invest in Ukraine and in shared security". Under the deal, joint ventures will be established between selected Ukrainian and European defense companies to fast-track the development and manufacturing of unmanned technologies. The alliance's work will focus on developing joint defense technologies, industrial cooperation, localizing production, strengthening component supply chains, and integrating Ukraine's defense industry into the European defense-industrial base. An initial meeting of the 18 founding members is scheduled to take place in Brussels in September. The Commission has also pledged €1 billion ($1.14 billion) to support Kyiv's drone capabilities as part of the €90 billion Ukraine Support Loan. Participating EU firms include ORQA (Croatia), Indra Group (Spain), Fincantieri (Italy), WB Group (Poland), Destinus (the Netherlands), Delair (France), Terma (Denmark), RSI Europe, and Quantum Systems (Germany). Ukrainian members include Skyfall Industries (developer of the Vampire heavy-strike drone), Greentech Harvest, Tencore, Deviro, Vyriy Industry, Athlon Avia, TAF Industries, UForce, and F-Drones. While most focus on aerial drones, Fincantieri and UForce will leverage their expertise in naval drones.

Simultaneously, the Pentagon's newly minted internal task force met for the first time following CIO Kirsten Davies' historic decision to initiate a 60-day pause on Phase 2 Cybersecurity Maturity Model Certification (CMMC) requirements. The Phase II requirements, which were originally scheduled to go into effect on November 10, 2026, would have required third-party cybersecurity assessments across all contracts involving sensitive but unclassified information. Davies announced the immediate suspension on July 13, stating: "In support of Secretary Pete Hegseth's directive to reduce compliance barriers for small and medium sized businesses, we are today suspending the CMMC Phase II requirements and initiating a 60-day study of the future of this program". She emphasized that the action "does not eliminate the legal requirement for our industry partners to protect federal data", clarifying: "We are not reducing cybersecurity through this measure. We are reducing the red tape". The pause aims to listen directly to the defense industrial base to ensure complex compliance rules aren't acting as a barrier to entry for highly innovative tech startups trying to do business with the military. Davies' memo pointed to "recent data and feedback" suggesting "the current CMMC program is structurally incompatible with our need to rapidly expand the DIB", citing reports from the Small Business Administration that "the combination of prohibitive compliance costs, severe shortages in third-party assessment capacity, and complex regulatory timelines is actively forcing innovative new entrants and small businesses to opt out of DoD contracts and freezing critical suppliers out of the market". The 60-day "CMMC Reform Task Force" has been tasked with providing recommendations on a framework that "prioritizes speed to capability, lowers barriers for small, medium, and non-traditional businesses, and replaces prohibitive, third-party compliance models with scalable, realistic security measures".

July 2026 marks a decisive shift in transatlantic defense cooperation and regulatory reform. The EU-Ukraine Drone Alliance and the €1 billion Drone Deal represent an unprecedented integration of Ukrainian combat expertise with European industrial capacity, formalizing joint ventures across 18 companies to mass-produce next-generation uncrewed systems. Simultaneously, the Pentagon's 60-day CMMC pause signals a fundamental rethinking of how cybersecurity compliance interacts with industrial base growth, acknowledging that prohibitive compliance costs are freezing innovative startups out of the defense market. The era of fragmented, bilateral drone procurement is ending. The era of integrated EU-Ukraine defense industrial partnerships—and streamlined, innovation-friendly cybersecurity frameworks—is already here.