Categories: Court Info

Mastering ITAR & EAR: Your US Export Controls Guide

Q: Can sharing technical data with a foreign national employee in the US be a violation?

Yes. This is known as a 'deemed export.' The release of controlled technology or source code to a foreign person within the US is treated as an export to that person's home country and may require a license under both EAR and ITAR.

META DESCRIPTION:

Navigate the complexities of US Export Controls. Learn the critical differences between the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR), understand how to classify your items, and implement the eight core elements of an effective compliance program to protect your business from multi-million dollar penalties.

Demystifying ITAR and EAR: Essential Compliance for Global Trade

For any company involved in international trade, manufacturing, or technology development in the United States, understanding export control regulations is not optional—it is a mandatory and critical aspect of risk management. The two pillars of US export control are the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). While both serve the overarching goal of safeguarding US national security and foreign policy interests, they govern different types of items and are enforced by different government bodies.

Failure to comply with these regulations can result in catastrophic financial and criminal penalties, including fines reaching up to $1 million per violation, imprisonment, and debarment from future export activities. This post will break down the essential distinctions between ITAR and EAR and outline the foundational elements required to build a robust, compliant export program.

The Fundamental Difference: USML vs. CCL

The easiest way to differentiate between the two regimes is by the items they control, which are defined by their respective control lists. ITAR is the more stringent of the two, focusing exclusively on defense and military-specific items, whereas EAR governs a much broader range of commercial and “dual-use” items.

1. International Traffic in Arms Regulations (ITAR)

ITAR is administered by the Department of State’s Directorate of Defense Trade Controls (DDTC). It controls the export and temporary import of defense articles, defense services, and related technical data that are specifically designed, developed, configured, or adapted for military purposes.

Controlled List: The United States Munitions List (USML), which includes 21 categories of articles, from firearms and ammunition to spacecraft and launch vehicles.
Requirement: Registration with the DDTC is mandatory for manufacturers, exporters, and brokers of USML items, even if they never export. Licensing is generally required for transfers.

2. Export Administration Regulations (EAR)

EAR is administered by the Department of Commerce’s Bureau of Industry and Security (BIS). It regulates “dual-use” items—goods, software, and technology that have both commercial and military or proliferation applications.

Controlled List: The Commerce Control List (CCL), which uses Export Control Classification Numbers (ECCNs) to categorize items.
Requirement: Licensing depends on the item’s ECCN, the destination country, the end-user, and the ultimate end-use. Items not on the CCL fall under the designation EAR99, which typically requires a license only for transactions involving sanctioned or embargoed countries, or prohibited end-users/end-uses.

Summary of Key Distinctions

Feature	ITAR	EAR
Governing Agency	Department of State (DDTC)	Department of Commerce (BIS)
Scope	Military and Defense Articles/Services (USML)	Commercial and Dual-Use Items (CCL)
Severity of Control	More stringent, almost always requires a license	Flexible, risk-based (ECCN, destination, end-user, end-use)

The Concept of “Deemed Export” and Technology Transfer

A frequent area of non-compliance arises from the concept of a “deemed export”. An export is broadly defined not only as a physical shipment out of the US but also as the release or transfer of controlled technology or source code to a foreign person within the United States.

For example, simply sharing technical specifications, providing access to a secure database containing controlled data, or giving hands-on training to a foreign national employee (even if they work in the US) can be considered a “deemed export” and may require a license, depending on the item’s classification and the foreign national’s country of citizenship.

Tip: Internal Technology Control Plans

To mitigate “deemed export” risk, organizations must implement robust internal access control measures, including network segmentation and identity management, especially for sensitive data and facilities. Visitor screening and clear foreign visitor policies are crucial components of this plan.

The Eight Core Elements of an Effective Export Compliance Program (ECP)

The Bureau of Industry and Security (BIS) and the Directorate of Defense Trade Controls (DDTC) strongly encourage organizations to establish a formal Export Compliance Program (ECP) to mitigate the risk of violations and penalties. An effective ECP is a series of procedures designed to facilitate compliance with export controls and is based on eight core elements.

Management Commitment: Senior management must publicly support compliance, provide sufficient resources (personnel, funding), and budget for internal improvements and outside expertise.
Risk Assessment: Identify and mitigate vulnerabilities through regular, at least annual, risk assessments based on the types of goods, destinations, and end-uses involved in your business.
Export Authorization Procedures: Develop written, step-by-step procedures for jurisdiction determination (ITAR vs. EAR), item classification (ECCN/USML category), licensing, and restricted party screening. This is the day-to-day work of compliance.
Recordkeeping: Establish clear procedures for retaining all export-related documentation (licenses, shipping records, end-use statements) to meet the requirements of EAR § 762.
Training: Require ongoing training for all relevant employees—from sales and engineering to shipping and support staff—to ensure they can recognize and escalate potentially sensitive issues (general awareness).
Audits: Conduct regular internal or external audits to gauge how well procedures are being followed and to proactively identify gaps that need augmentation.
Handling Violations and Corrective Actions: Implement a clear program on how to respond to a discovered violation, including internal investigation, taking corrective action, and deciding whether to make a Voluntary Self-Disclosure (VSD) to the relevant agency (DDTC or BIS).
Building and Maintaining the ECP Manual: Keep the written compliance manual current, relevant, and accessible to all members of the organization.

Recommended: US Law Menu Tree

CASE SPOTLIGHT: The Cost of Inaction

In a recent high-profile case, a US manufacturing company was required to pay multi-million-dollar fines for unauthorized exports and other violations of ITAR, underscoring the severity of enforcement. Agencies are increasingly focused on non-monetary penalties, such as debarment from exporting or loss of privileges, which can be a death blow to a globally-focused business. Timely voluntary self-disclosure, facilitated by a strong ECP, is often cited as a mitigating factor in penalty determination.

Summary and Next Steps for Compliance

The world of US export controls is complex and constantly evolving. Proactive compliance is the only way to safeguard your international business operations and protect your company’s reputation and financial health. The core requirement is a commitment to proper classification and a systematic, institutionalized compliance program.

Know Your List: Immediately determine if any of your items, components, or technology fall under the stringent USML (ITAR) or the broader CCL (EAR), as this dictates your entire compliance roadmap.
Address Deemed Exports: Screen foreign national employees and implement strict access controls to prevent the inadvertent release of technical data within US borders, which is a common violation.
Establish an ECP: Implement the eight elements of an Export Compliance Program—from management commitment to regular auditing—to create a system of repeatable procedures that minimize risk.
Conduct Due Diligence: Rigorously screen all potential parties in a transaction against the Consolidated Screening List (CSL) and other restricted party lists maintained by the US government.

Your Export Compliance Roadmap

Compliance is a continuous process, not a one-time event. Whether you are a small manufacturer or a large aerospace supplier, a clear understanding of ITAR and EAR’s extraterritorial reach is vital. Consult with a seasoned Legal Expert who specializes in global trade law to tailor an ECP to your organization’s unique risks, ensuring that your international operations remain secure and fully compliant.

Frequently Asked Questions (FAQ)

What is the primary difference between ITAR and EAR?

ITAR governs military and defense-related items on the US Munitions List (USML) and is administered by the Department of State. EAR governs commercial and “dual-use” items on the Commerce Control List (CCL) and is administered by the Department of Commerce.

What is an ECCN and why is it important?

ECCN stands for Export Control Classification Number. It is a five-character alphanumeric code used under EAR to classify a dual-use item and determine the specific licensing requirements based on the destination, end-user, and end-use. Correct ECCN classification is the essential first step in EAR compliance.

Can sharing technical data with a foreign national employee in the US be a violation?

Yes. This is known as a “deemed export.” The release of controlled technology or source code to a foreign person within the US is treated as an export to that person’s home country and may require a license under both EAR and ITAR.

What are the penalties for ITAR and EAR violations?

Penalties are severe and include civil fines up to $1 million (or more) per violation, criminal penalties (up to 20 years imprisonment), and the administrative sanction of being denied export privileges.

What does an “EAR99” item mean?

EAR99 is the designation for items subject to the EAR but not specifically enumerated on the Commerce Control List (CCL). These are generally low-technology consumer goods. They typically do not require a license, except when intended for sanctioned/embargoed destinations or prohibited end-users/end-uses.

Disclaimer: AI-Generated Content

This blog post was generated by an artificial intelligence model and is intended for informational and educational purposes only. It does not constitute legal advice, and you should not act or rely upon any information contained herein without seeking the advice of a qualified Legal Expert. Export control regulations (ITAR, EAR, and others) are subject to change and specific facts and circumstances will determine your legal obligations. Always consult the latest version of the Code of Federal Regulations (CFR) and official agency guidance from the DDTC and BIS.

ITAR compliance, EAR regulations, US export controls, dual-use items, Commerce Control List, US Munitions List, ECCN classification, DDTC registration, export compliance program, deemed export, BIS penalties, DDTC fines, export license requirements