Defense Tech BaseClassify the item and activity before deciding the rules
ITAR and EAR are different US export-control regimes. A defense customer does not automatically make every product ITAR-controlled, and a commercial product can still be subject to the EAR. Hardware, software, technical data, services, destination, recipient and end use can each matter. Use this guide to prepare a focused review with qualified export counsel or an adviser; it cannot classify an unspecified product.
The useful distinction
| Question | ITAR | EAR |
|---|---|---|
| Responsible department | State Department, Directorate of Defense Trade Controls. | Commerce Department, Bureau of Industry and Security. |
| Classification starting point | US Munitions List and the relevant definitions and jurisdiction. | Whether the item is subject to the EAR, then the Commerce Control List and ECCN, or EAR99 where appropriate. |
| What to avoid assuming | Registration is not permission to export. | EAR99 does not mean every destination, party or end use is permitted. |
| Useful adviser deliverable | A documented jurisdiction and registration/licensing analysis tied to your item and activities. | A documented classification and transaction review, including any license requirement or exception relied on. |
Start with the official BIS classification guidance and the US Munitions List. A part’s name or the customer’s industry is not enough to settle jurisdiction.
Can ITAR registration apply if we never export?
Yes. 22 CFR 122.1 states that covered manufacturers must register even if they do not export, and also lists exemptions. Whether your activity falls within the rule or an exemption needs a specific assessment. Registration does not grant export rights. When evaluating a supplier, ask for current registration evidence through an appropriate private channel and verify the legal entity and scope; do not treat a website badge as an export authorization or quality certification.
Map access to technology, not just shipments
An export review should include cloud systems, source repositories, demonstrations, remote support, overseas contractors and technical discussions. Under the EAR, releasing certain controlled technology or source code to a foreign person in the United States can be a deemed export. BIS explains the relevant definitions, exceptions and citizenship or residency considerations in its deemed-export guidance.
For a hiring or access decision, ask counsel to assess the person’s relevant status, actual role, technology and required authorization. Do not replace that analysis with a blanket citizenship hiring rule. Prepare role-specific access controls and onboarding steps that match the review’s conclusions.
Prepare a classification review packet
- Item: Identify the product version, hardware, software, technical data and related services.
- Technical function: Explain what it does and which specifications may matter. Provide sensitive detail only through a suitable channel.
- Development history: Identify changes from commercial components, design requirements and existing classification records.
- Activity: Describe shipment, demonstration, access, manufacture, integration or support.
- People and places: List relevant entities, countries, users and proposed access.
- Decision: State what must be resolved and before which business action.
Ask the adviser to document assumptions, unresolved facts, classifications, applicable authorizations and circumstances that would require a new review. Keep the decision connected to the actual product configuration.
Choose export-control help
Use the export-compliance provider category to identify relevant advisers. Ask about experience with your technology, who signs off on the analysis, what is included in a fixed review, and how questions after delivery are handled. A classification memo, a registration filing and a license application are different deliverables. Compare them separately using the provider workbook.
For a manufacturer, ask which legal entity will perform the work, where subcontracted processes occur, how controlled drawings are accessed and how changes are approved. For software, focus on repositories, hosted environments, support access and updates. “We are compliant” is less useful than a documented explanation of the proposed workflow.
Your next step
Prepare the six-part packet and a provider brief. If the underlying requirement involves classified work, use the separate facility-clearance and FOCI guide; export controls and facility clearances answer different questions.