Introduction
The Turkish defence and aerospace industry has undergone a profound transformation in recent years. According to the 2025 Annual Report of the Secretariat of Defence Industries of the Presidency of the Republic of Türkiye, defence and aerospace exports rose by 48 per cent compared with the previous year to reach USD 10.054 billion, and the Report confirms that the sector has grown into a robust ecosystem with more than 3,500 companies, over 1,400 projects and a turnover exceeding USD 20 billion.
This growth makes it all the more important for companies operating, or planning to operate, in the sector to identify their obligations under the applicable legal framework.
Defence industry law comprises a multi-layered body of legislation that is difficult to consolidate into a single statute. Its foundations lie in Law No. 5201 on the Control of Industrial Establishments Producing War Vehicles and Equipment, Weapons, Ammunition and Explosives (“Law No. 5201”) and the Defence Industry Security Law No. 5202 (“Law No. 5202”).
Law No. 5201 addresses the setting up and operation of industrial establishments producing items used in the defence industry, the obligations to which they are subject and the control exercised over them, whereas Law No. 5202 lays down the principles and procedures governing the security and protection of activities carried out in the defence industry.
This article examines the core framework established by Law No. 5201 and Law No. 5202 from a practical perspective.
I. Key Provisions of Law No. 5201
A. Scope and Principal Obligations
Law No. 5201 applies to all public institutions and organisations, as well as establishments owned by natural and legal persons, that are set up or operated to produce war vehicles and equipment of any kind, weapons, ammunition and spare parts thereof, and explosives. The most fundamental obligation it imposes is that the establishment or operation of any such facility requires the permission of the Ministry of National Defence (“MSB”), granted after the opinion of the Ministry of Industry and Trade has been obtained.
Law No. 5201 also imposes extensive notification obligations on the establishments within its scope. Accordingly, such establishments must notify the MSB of their founders, their capital structure and the identities of the members of their board of directors and supervisory board and of the persons authorised to represent and bind the company, as well as of any change in this information within one month of the date of the change. They are further required to report, each January, the types and stock levels of the products they manufacture and, within one month, the types and quantities of orders received.
The list of war vehicles and equipment subject to control (the Control List, Kontrole Tâbi Liste) is published by the MSB in the Official Gazette each January, after the opinions of various ministries and institutions have been obtained.
B. Sanctions
Law No. 5201 provides for severe sanctions for non-compliance. Those who establish a facility without permission face imprisonment of two months to one year, those who fail to comply with the notification obligations face imprisonment of one to six months, and those who export without permission face imprisonment of one to five years. A judicial fine is also provided for in respect of each of these offences. A further type of sanction, which the MSB may request from the competent court, is the closure of facilities established without permission and a prohibition on the sale and shipment of their materials.
II. Law No. 5202 and Security Obligations
The purpose of Law No. 5202 is to ensure the security and protection of all classified information, documents, projects, materials and services that are provided for in agreements concluded within the scope of the defence industry and are to be procured through direct purchase, participation in joint project programmes, incentives or investment, or that belong to natural and legal persons engaged in research, development, manufacturing and assembly in the field of defence industry, technology and equipment, and to individuals working in these fields.
Law No. 5202 covers all legal persons governed by public or private law that purchase, sell, produce, research and develop, safeguard or store any classified agreement, information, document, project, material or service. This is an exceptionally broad scope: even consultancy firms, software companies, logistics companies and subcontractors seeking to take part in a defence project fall within this legal framework.
Under Law No. 5202, The National Security Authority for the Defense Industry the Ministry of National Defence has been designated as the Ministry of National Defence. In practice, this function is performed by the MSB General Directorate of Technical Services.
A. Security Classification
Article 5 of Law No. 5202 provides that the principles and procedures governing the assignment of security classifications to defence industry information, documents, materials and projects, their marking, transfer, safekeeping, reclassification and disclosure, and training in these matters are to be laid down by regulation, taking into account the approved decisions of the Multinational Industrial Security Working Group (MISWG) and the defence industry cooperation agreements signed with other countries. The Defence Industry Security Regulation and the MSY 317-2(C) Defence Industry Security Directive, issued pursuant to this Article, govern classification within the Turkish defence industry security system. Under this framework, national security classifications are set at four levels:
Top Secret (Çok Gizli) is used for information and documents whose unauthorised disclosure could cause exceptionally grave damage, in vital respects, to the security of the State, to national existence and integrity and to allies, and could have extraordinary consequences for security.
The Secret (Gizli) classification is reserved for information and documents whose disclosure could cause serious damage to national security and national interests or could benefit a foreign state.
The Confidential (Özel) classification applies where disclosure could undermine the prestige and interests of the State or cause harm to an individual.
Restricted (Hizmete Özel) is intended for information that does not require protection at the Top Secret, Secret or Confidential level but should not be known to anyone other than those who need to know it.
The significance of this hierarchy is not merely theoretical. For systems classified Confidential or above, exceptional electromagnetic security measures such as TEMPEST are mandatory. Furthermore, classified documents, including those classified Restricted, may not be transmitted by facsimile or e-mail. A breach of these rules gives rise to serious legal risks in terms of project continuity, legal liability and document security.
The classification system fulfils its true function in conjunction with the “need-to-know basis”. Law No. 5202 defines a “person with a need to know” as a person who, solely by virtue of his or her duties, is responsible for learning and using classified information, documents, projects or materials, and who holds a Personnel Security Clearance (Kişi Güvenlik Belgesi, “PSC”) at the required classification level. Holding a PSC does not mean that a person may access all classified information relating to a project; access is confined to what that person needs to know in order to perform his or her duties. In other words, two engineers working on the same project within a company may have access to different parts of it; indeed, a legal adviser may be authorised to know only the contractual aspects of the project, not its technical secrets.
III. Personnel Security Clearance (PSC)
Article 6 of Law No. 5202 sets the most critical threshold for legal relationships in the defence industry: a Personnel Security Clearance (PSC) must be obtained for every person who has access to classified information, documents, projects or materials. Until such clearances have been obtained, classified information may not be disclosed, the premises where such information is held may not be entered, and no one may take part in work on, or the performance of, agreements, contracts or subcontracts containing classified information.
The exceptional practical significance of this provision stems from the fact that a PSC is mandatory in order to take part in contract negotiations for, or the performance of, a classified defence project. This applies not only to production staff but also to the legal advisers, accountants, project managers and technical personnel of the project concerned.
A. Persons Required to Obtain a PSC
Chapter Five of the MSY 317-2(C) Directive sets out in detail the persons for whom a PSC application must be made. In establishments organised as partnerships, all partners fall within this scope; in joint stock companies, the scope covers shareholders permitted by a resolution of the board of directors to access classified information, documents and materials, members of the board of directors, the general manager and deputy general managers, the security coordinator and all personnel likely to have access to classified information. No application is made for persons who will not have access to classified information, such as cleaning staff, drivers, accounting staff and interns.
B. Application Process, Period of Validity and Mandatory Renewal
PSC applications are submitted to the MSB by the establishment concerned, and, at the MSB’s request, a security investigation and archive research are conducted by the National Intelligence Organization (MİT), the General Directorate of Security or the local civil administrative authorities. A PSC is valid for a maximum of five years, and a renewal application must be filed six months before its expiry; otherwise, the PSC ceases to be valid.
Establishments are also required to carry out criminal record checks every six months throughout the validity period of a PSC. Any criminal prosecution or conviction must be reported immediately to the Defence Industry National Security Authority. Where a person’s PSC is revoked, that person’s role in the project on which he or she is working also comes to an end.
Since missing the renewal deadline may, in practice, mean being unable to continue with the project, it is critically important to monitor the PSC renewal schedule of all key personnel involved in the project.
IV. Facility Security Clearance (FSC)
While a PSC is an individual security clearance, a Facility Security Clearance (Tesis Güvenlik Belgesi, “FSC”) is the corporate security clearance required for an establishment to carry out classified projects. A facility at which a classified project is to be carried out must hold an FSC. Even if an individual holds a PSC, a classified project cannot be carried out at the facility where he or she works if that facility does not hold an FSC.
The licensing process cannot even begin without an understanding that, under Law No. 5201, permission to establish or operate any facility within its scope rests with the Ministry of National Defence, that the opinion of the Ministry of Industry and Trade must be obtained prior to the application, and that the land on which the facility is to be built must not fall within the scope of Law No. 2565 on Military Forbidden Zones and Security Zones.
Once the necessary permits and certificates have been obtained, the next stage is the Production Permit Certificate (Üretim İzin Belgesi), which is required before production activities can commence under Law No. 5201. If any link in this chain is missing, production and delivery cannot begin, even where the contract has already been signed.
V. Conclusion
The momentum the defence industry has gained in recent years has also brought the legal requirements specific to this field to the fore. For companies operating, or planning to operate, in the sector, compliance with defence industry legislation is of great importance.
Two key points warrant particular attention in this process. First, project timelines must be planned well in advance to accommodate PSC and FSC applications; the inability to join a classified project without the requisite clearance is not merely an administrative issue, as it also entails the risk of exclusion from the contract and of legal liability. Second, measures relating to the classification and protection of classified information must be treated not merely as technical requirements, but as obligations carrying the risk of legal sanctions under Law No. 5202.
Whether growth in the defence industry translates into sustainable commercial activity depends on addressing the legal framework systematically and in parallel with technical activities, and on compliance with the legislation.
Kind regards,
Kılınç Law & Consulting
