[Home](/)/[Resources](/resources)/Export Control and Dual-Use

export controldual-useEARglobal compliance

# Export Control and Dual-Use Regulations for Electronics Hardware Companies

Export control regulations restrict the export of certain electronics hardware, components, and technology because of their potential military or proliferation applications. Hardware companies that export globally — particularly products containing encryption, high-performance computing, RF technology, or advanced semiconductors — must classify their products and screen customers before shipping. Getting this wrong carries criminal penalties.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fexport-control-dual-use)

[Check my export control obligations](/platform/new)

US export controls

## EAR and ITAR: the two US export control regimes

The US Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS) within the Department of Commerce, control the export of dual-use goods — commercial products and technology that have potential military applications. The Commerce Control List (CCL) enumerates controlled items by Export Control Classification Number (ECCN). Electronics hardware categories most commonly controlled under EAR include: encryption products (Category 5, Part 2 — 5A002, 5E002), telecommunications and information security equipment; high-performance computing equipment above certain performance thresholds (Category 4 — 4A003); electronic components and systems with military performance specifications (Category 3 — 3A001, 3A002); and sensors and laser technology (Category 6).

Key encryption note: any product containing encryption above a basic strength threshold — including most commercial Wi-Fi, Bluetooth, TLS, and VPN implementations — falls within Category 5, Part 2 of the EAR. However, most commercial encryption products qualify for License Exception ENC (Encryption) which permits export to most civilian end users without individual license applications. ENC requires a one-time registration with BIS and annual reporting. Most hardware companies with wireless products need to address ENC compliance even if they are otherwise EAR99.

ITAR (International Traffic in Arms Regulations, administered by the Directorate of Defense Trade Controls at State) covers defense articles and defense services on the US Munitions List. Commercial electronics hardware is typically EAR, not ITAR — but hardware designed for military specifications, manufactured under military contracts, or integrating into weapons or surveillance systems may be ITAR-controlled. ITAR carries no license exceptions equivalent to ENC — licenses must be individually obtained, and the registration and compliance burden is substantially higher than EAR.

EU dual-use controls

## EU Dual-Use Regulation 2021/821 and how it works

The EU Dual-Use Regulation (Regulation 2021/821) controls exports of dual-use goods from EU member states. The EU control list mirrors much of the Wassenaar Arrangement control list, which also forms the basis of the US CCL. Products controlled by EU Dual-Use regulation require an authorization (license) before export from an EU country to non-EU destinations, unless covered by an EU General Export Authorization (EU GEA).

EU General Export Authorizations (EU 001 through EU 006 and national GEAs) provide blanket authorization for exports of specific product categories to specified low-risk destinations (typically other advanced economies — US, Japan, Australia, New Zealand, Canada, UK, Switzerland, Norway). EU GEA EU 001 covers most dual-use goods exported to these countries without individual license. For controlled goods exported to countries not covered by EU GEAs, individual export authorizations must be obtained from the national competent authority of the exporting member state.

The 2021 reform of the EU Dual-Use Regulation introduced human rights-related controls: cybersurveillance items (surveillance technology capable of covertly monitoring individuals) are now subject to enhanced controls. For hardware companies making products that could be used in mass surveillance, communications interception, or location tracking, the human rights end-use clause in Article 5 of the Regulation may require individual license assessment regardless of whether the product is on the formal control list.

Compliance program

## Building an export control compliance program for hardware companies

Product classification: classify every product you export under the US CCL (ECCN or EAR99) and the EU Dual-Use control list. Document the classification basis — for ECCN assignments, the specific technical parameters that place the item within or outside the listed control parameters. For encryption products, file the ENC registration with BIS and establish the annual reporting process.

Restricted party screening: before every export transaction, screen the customer (end user), shipper, and any other parties to the transaction against US denial lists (Entity List, Denied Persons List, Specially Designated Nationals List, Debarred Parties List) and EU restrictive measures. Most trade compliance software integrates these checks. Screening cannot be skipped even for EAR99 items or EU GEA-covered exports — denied parties cannot receive US-origin goods or EU dual-use goods regardless of control classification.

Destination controls: exports to embargoed countries (US: Cuba, Iran, North Korea, Syria; EU: Belarus, Russia, Myanmar, and others) require individual licenses or are prohibited outright. Red flag awareness: if something about a transaction seems unusual — customer reluctance to identify end use, requests for products inconsistent with stated business, unusual shipping routes — it triggers an affirmative obligation to inquire further before proceeding.

## Learn this properly, not just for one product

In-depth courses and books that teach the process — not a one-off answer you'll need to look up again next time.

[Browse courses](/courses)[Free Compliance Roadmap](/platform/new)

[Prefer to read? Get the book](/books)

## Frequently asked questions

### What is an ECCN and how do I find mine?

An Export Control Classification Number (ECCN) is a 5-character alphanumeric code assigned under the US Export Administration Regulations (EAR) to classify goods, software, and technology for export control purposes. For electronics, common ECCNs include 5A002 (information security equipment), 3A001 (electronic components), 4A003 (computers), and 5E002 (information security technology). To determine your ECCN: review the Commerce Control List (CCL) in 15 CFR Part 774 against your product's technical parameters. BIS (Bureau of Industry and Security) offers a self-classification process and can provide formal commodity classification through a request.

### What does EAR99 mean?

EAR99 is the classification for items that are subject to the EAR but not listed on the Commerce Control List — they have no specific ECCN. EAR99 items generally do not require an export license for most destinations and end users. However, EAR99 items still cannot be exported to embargoed countries (Cuba, Iran, North Korea, Syria) or to parties on denial lists (Entity List, Denied Persons List) without a license. EAR99 does not mean 'export freely' — end-user and end-use screening is still required.

### What is the difference between EAR and ITAR?

The EAR (Export Administration Regulations, administered by BIS/Commerce) covers dual-use commercial goods and technologies — items with both commercial and potential military applications. ITAR (International Traffic in Arms Regulations, administered by DDTC/State) covers defense articles and services on the US Munitions List. Electronics hardware is usually EAR-controlled. Items specifically designed for military applications — military-grade electronics, certain encryption hardware for government use, satellite components — may be ITAR-controlled. ITAR carries significantly stricter controls and penalties.

### Does the EU Dual-Use Regulation apply if I'm a US company?

The EU Dual-Use Regulation (Regulation 2021/821) applies to exports from EU member states — so it applies to any company exporting from an EU location, regardless of nationality. If your EU subsidiary or manufacturing operation ships controlled goods from an EU country, EU Dual-Use authorization rules apply for exports to non-EU destinations. A product may be subject to both EU and US export controls if it is manufactured in or transits through EU and US jurisdictions.

[

Map your product, free

Every standard, document, and test that applies — free, no account required.

Start mapping](/platform/new)[

Want an expert to handle your compliance for you?

One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts.

See compliance services](/services)

Related guides

*   [US HTS Codes for ElectronicsHarmonized Tariff Schedule (HTS) codes determine import duty rates for electronics entering the United States.](/guides/us-hts-codes-electronics)
*   [EU CN Codes for ElectronicsThe EU Combined Nomenclature (CN) is the 8-digit customs classification system for all EU imports.](/guides/eu-cn-codes-electronics)
*   [EU Supply Chain Due Diligence (CSDDD)The EU CSDDD (Directive 2024/1760) requires large companies to identify, prevent, and address adverse human rights and environm…](/guides/eu-supply-chain-due-diligence)
*   [India Legal Metrology ActIndia's Legal Metrology (Packaged Commodities) Rules 2011 require mandatory labelling of MRP, net quantity, manufacturer identi…](/guides/india-legal-metrology-act)

Educational resource only. Export control regulations change frequently. Control lists, license exceptions, and embargoed country lists are updated regularly by BIS (US) and the European Commission. Verify current requirements with a qualified export control attorney or consultant before shipping.