The Compliance Obligation You Never Signed Up For: PV Security Grading And The Defense Sector

Addressing the legal framework governing U.K. Government powers over privately developed defense technology.

Introduction

You have not entered into a contract with the MOD. Your technology was developed entirely with private funding. No government agency has contacted you. And yet your company may already be subject to security handling obligations under MOD policy—obligations that, if breached, could cut you off from the classified U.K. defense supply chain, prevent you from demonstrating your technology at the exhibitions where deals are done, and exclude you from every serious international industry event in your sector.

This is the world of Private-Venture (PV) Security Grading: a compliance framework that captures an expanding range of privately funded defense companies, often without those companies fully understanding when or how it applies to them. This article explains what PV Security Grading is, how it operates in law, and—critically—the trigger events that make it effectively unavoidable for any serious participant in the U.K. defense market.

What is PV Security Grading?

PV Security Grading is an MOD-run process for privately funded, defense-related equipment and technology. The MOD, upon request, will assess whether the item is nationally sensitive and, where it is, allocate a U.K. security classification—official-sensitive, secret or top secret—for handling purposes.

Once the MOD has issued a PV Security Grading, the company must handle the technology to precisely the same security standards as if the material carried the equivalent Government Security Classification (GSC) level. These are the full suite of access controls, marking requirements, storage protocols, and personnel security obligations that apply to classified government information.

Critically, however, unlike the statutory secrecy order regime under the Patents Act 1977, the MOD does not have a general statutory power in peacetime to classify private information or property and make its misuse a criminal offense. The Crown's prerogative powers extend to matters such as the disposition and use of the armed forces in defense of the realm, the conduct of foreign affairs and treaty relations, and national security decision-making—but they do not extend to the classification or taking of private property without statutory authority. Outside the narrow compulsory regime in the Patents Act, the government can only act by contract or consent, and that is precisely what the PV grading scheme represents.

When a company submits a PV Security Grading application, it enters a consensual administrative relationship with the MOD. As part of that application, the company undertakes that it will handle, mark, and store the technology to the standards specified for the assigned classification; that it will not disclose it abroad or to foreign nationals without MOD consent; and that it will notify the MOD of any change of control, ownership, or location of the item. That undertaking is the contractual consideration for the MOD's service.

If a company breaches those obligations, the MOD cannot impose criminal liability (absent another applicable statute). The consequences that follow from breach are instead commercial and reputational. The MOD can: refuse future applications for PV grading, PV/Ex clearance, and F680 approval—effectively closing off re-entry to the classified market; notify prime contractors and accredited facilities of noncompliance, cutting the company off from the classified supply chain (since primes whose own security flow-down terms require PV grading as a condition of continued participation will treat the company as disqualified); withdraw government export promotion support through U.K. Defense and Security Exports; and pursue the company in civil proceedings for breach of the undertaking given on application.

There is no appeals process for PV Security Grading. The official guidance confirms that assessments are made on the information provided in the application and there is no right of appeal, though a further application may be made if circumstances change.

So why would a defense tech company ask the MOD to classify its PV technology, given the onerous obligations which flow from this?

Trigger one: it is required to do so by a term of a contract with a prime in relation to a classified project

When the MOD commissions and funds a program—in whole or in part—it assigns a Government Security Classification to the program and its associated information. That classification is applied by the MOD directly, by virtue of its status as commissioner and funder, and attaches to the government-funded elements of the work as a matter of course. It is not PV grading: it is direct government classification of government-funded activity, and it requires no application from the contractor.

The PV grading obligation arises at a separate level and in relation to different subject matter: the contractor's privately funded technology that sits alongside, feeds into, or is derived from the MOD-funded program. Because that technology was developed with private funds, it is not government property and has not been classified as part of the program. It therefore requires its own separate classification—and the mechanism for obtaining that classification is PV grading.

The contractual instrument that imposes this obligation is the Security Aspects Letter (SAL), issued by the MOD to the prime contractor. The SAL sets out the security requirements for the program—including what classification level applies—and requires the prime to ensure that any related privately funded activity has been formally security graded by the MOD Directorate of Security and Resilience. Prime contractors are required to flow this obligation down to subcontractors through their own supply chain security terms, with the result that a company that has no direct relationship with the MOD may nonetheless find itself contractually required to obtain PV grading as a condition of continued supply chain participation.

Privately funded activity that falls within the scope of this obligation is defined in three categories:

• Variants: standard defense equipment with nonstandard fitments or modifications.

• Derivatives: equipment not based on standard designs but dependent on expertise or technology acquired through defense contracts.

• Freelance: equipment of defense importance with no basis in information from defense contracts.

The Derivative and Freelance categories are particularly significant for technology companies. A company that develops commercial off-the-shelf software subsequently integrated by a prime into a classified platform—without itself holding an MOD contract—may find that its technology falls within one of these categories, and that the prime's security flow-down terms require it to have obtained PV grading before the integration can proceed. The obligation is therefore not limited to direct MOD contractors: it extends through the supply chain to any company whose privately funded technology touches a classified program.

Trigger two: export licensing and participation in defense exhibitions

The second major trigger for PV Security Grading is a company's wish to exhibit its products at a defense exhibition outside the U.K.

PV goods, software or technology appearing on the U.K. Military List will fall within the U.K. export control regime. Any export for the purposes of a defense exhibition will require an export license. Typically, defense tech companies will seek to rely on the U.K. Open General Export License (OGEL) (Export for Exhibition: Military Goods) (dated May 9, 2025). However, condition three (one)(b) of this OGEL requires companies to have sought Private Venture exhibition clearance (PV/Ex clearance).

This is an event-specific approval to exhibit or discuss private venture technology at a particular MOD-sponsored event. While this is a separate process to PV Security Grading, and the OGEL does not expressly require the applicant to obtain a PV Security Grading, it is understood that in practice, the MOD will carry out a PV Security Grading as an initial step in assessing the application for PV/Ex clearance, and any clearance will be conditional on the applicant agreeing to comply with that security grading.

The U.K. Government leverages its statutory power to control exports under the Export Control Act 2002 and Export Control Order 2008 to obtain voluntary submission by a defense tech company to a PV Security Grading.

If the defense exhibition targeted by the U.K. defense tech company takes place in the U.K. itself, the U.K. export control regime will not be engaged, and an export license will not be required. In this case, the U.K. Government loses its leverage over PV defense tech companies. However, it is understood that, even in this situation, there is no escape. The MOD has other sources of leverage over defense exhibition organizers, and uses that leverage to insist that the exhibition organizer does not accept any would-be exhibitors wishing to exhibit or discuss relevant PV technology unless they have first obtained both PV Security Grading for the PV technology and PV/Ex clearance for the specific event.

Key takeaways

• The U.K. Government does not have the power, either under statute or the prerogative, to impose a security classification or restrictions on the promotion and use of privately developed technology, at least in peacetime. However, PV Security Grading and PV Exhibition Clearance operate through consent and contract.

• Despite this, PV Security Grading is effectively unavoidable for any company wishing to participate seriously in the U.K. defense market—whether through the MOD supply chain or international commercial activity. In practice, companies and founders find themselves making what is formally a voluntary application for PV Security Grading, but which is in commercial terms effectively compulsory.

• Breach of these compliance requirements does not expose a company to criminal liability, but the commercial consequences are severe. For example, a company puts at risk its contracts with prime contractors, and the future refusal of PV Security Grading and export licenses.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.