Export Controls

Export controls are the US rules governing what technology, software, and hardware can leave the country and who's allowed to see it. Two regimes do most of the work: ITAR, run by the State Department, covers defense articles on the US Munitions List, and the EAR, run by Commerce, covers dual-use items on the Commerce Control List. The rule that catches companies out is the deemed export: showing controlled technology to a foreign national on US soil counts as an export.

What's the difference between ITAR and the EAR?

Same country, two regimes, different agencies, different lists, and different rules for the same employee.

What's actually controlled?

Under ITAR, the question is whether the item, the technical data, or the service appears on the US Munitions List. If it does, ITAR governs it, regardless of how commercial the buyer looks.

Under the EAR, the scope is wider and less intuitive. Rather than paraphrase it, use Commerce's own words at 15 CFR 730.3: items subject to the EAR "include purely civilian items, items with both civil and military, terrorism or potential WMD-related applications, and items that are exclusively used for military applications but that do not warrant control under the ITAR."

Technology and software count as items. That's the part employees miss, because nothing gets boxed and shipped.

What is the deemed export rule?

A release of controlled technology or source code to a foreign person inside the United States is treated as an export to that person's country. No border is crossed. Sharing a schematic in a design review, granting repository access, walking a visitor through a lab, or troubleshooting over a screen share can all qualify.

The two regimes assign the country differently, and merging them is a common error. Under the EAR at 15 CFR 734.13(b), "[a]ny release in the United States of 'technology' or source code to a foreign person is a deemed export to the foreign person's most recent country of citizenship or permanent residency." Under ITAR at 22 CFR 120.50(b), "[a]ny release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency." For a dual national, ITAR reaches both countries and the EAR reaches the most recent one.

One scope note worth carrying: 15 CFR 734.13(b) is written in terms of "technology" and source code.

Who needs export control training?

Anyone who can put controlled technology in front of someone. In practice that's engineering and R&D, IT and anyone who administers access, HR and recruiting, procurement and logistics, sales and field service, and the people who host visitors.

Recruiters and hiring managers matter more than their job titles suggest, because the deemed export question arrives during onboarding rather than at a loading dock. Screening counterparties belongs in the same program, which is why sanctions screening and export controls usually share an owner, and why trade exposure should be scored in your compliance risk assessment rather than treated as a specialist concern.

What are the penalties?

Both regimes carry serious criminal exposure. A willful violation of the Arms Export Control Act draws a fine of up to $1,000,000 and up to 20 years under 22 U.S.C. 2778(c). Under the EAR, willful violations carry the same maximums, up to $1,000,000 and up to 20 years, per 15 CFR 764.3 and 50 U.S.C. 4819(a). Civil penalties under the EAR run to the maximum set by the Export Control Reform Act, which adjusts, so check the current figure rather than quoting an old one.

FAQ

Is it an export if nothing leaves the country?

It can be. Releasing controlled technology or source code to a foreign person inside the US is a deemed export under 15 CFR 734.13(b), and ITAR has its own version at 22 CFR 120.50(b).

For a dual national, which country counts?

It depends on the regime. Under 22 CFR 120.50(b), ITAR treats the release as an export to all countries in which the person has held or holds citizenship or holds permanent residency. Under 15 CFR 734.13(b), the EAR looks to the most recent country of citizenship or permanent residency.

Does hiring a foreign national require a license?

The export control trigger is the release of controlled technology or source code to a foreign person, under 15 CFR 734.13(b) and 22 CFR 120.50(b), so the question is about access. Put access decisions in the onboarding workflow rather than after the first project assignment.