[Home](/)/[Resources](/resources)/ITAR vs EAR Guide

USExport Controls

# ITAR vs EAR: Which US Export Control Framework Applies to Your Electronics Product

US export controls on electronics are enforced with criminal penalties that reach $1 million per violation — and connected hardware companies with encryption capabilities are frequently non-compliant without knowing it. Understanding whether your product falls under ITAR or EAR, and what that classification requires, is non-negotiable before your first international shipment.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fus-itar-ear-electronics)

At a glance

ITAR

State Dept / DDTC — defense articles

EAR

Commerce Dept / BIS — dual-use

Most electronics

EAR (CCL)

ITAR trigger

US Munitions List (USML) categories

## Understanding the two US export control regimes

### ITAR and the US Munitions List — defense articles and services

The International Traffic in Arms Regulations (22 CFR Parts 120–130), administered by the State Department's Directorate of Defense Trade Controls (DDTC), control items on the US Munitions List (USML). ITAR covers articles, technical data, and services specifically designed or modified for military or defense applications — including electronics designed for weapons systems, military communications, and space systems with national security applications. ITAR registration with DDTC is mandatory for any US company that manufactures or exports USML items, regardless of whether an actual export is planned.

### EAR and the Commerce Control List — dual-use electronics

The Export Administration Regulations (15 CFR Parts 730–774), administered by the Commerce Department's Bureau of Industry and Security (BIS), cover dual-use items with both commercial and potential military or proliferation applications. Most electronics — semiconductors, encryption modules, test equipment, and telecommunications hardware — fall under the EAR. Each controlled item has an Export Control Classification Number (ECCN) on the Commerce Control List. Items not on the CCL are classified EAR99 and are subject to minimal licensing requirements for most destinations.

### Export Control Classification Numbers (ECCNs) — the key to EAR compliance

An ECCN is a five-character alphanumeric code (e.g. 3A001 for electronic components, 5E002 for encryption technology) that identifies the applicable controls. The ECCN determines which countries require an export licence (based on Reason for Control: NS for national security, AT for anti-terrorism, EI for encryption items, etc.) and which licence exceptions may be available. Misclassifying a product as EAR99 when it should carry an ECCN is a common and serious violation.

### End-use and end-user controls — EAR99 is not a free pass

Even EAR99 items — those not on the Commerce Control List — face export restrictions when destined for embargoed countries (Cuba, Iran, North Korea, Syria, Russia under current orders), entities on the BIS Entity List or Denied Persons List, Treasury OFAC Specially Designated Nationals, or State Department Debarred parties. The Consolidated Screening List (CSL) aggregates these restricted parties into a single searchable database. Screening every customer, consignee, and end-user against the CSL before each shipment is a foundational export compliance obligation regardless of ECCN classification.

## How to classify your electronics product under US export controls

01

Screen your product against the US Munitions List (USML) in 22 CFR Part 121 — if the product was specifically designed or modified for a military or defense application covered by USML Categories I through XXI, ITAR applies and DDTC registration is required before any export, re-export, or transfer of the item or its technical data.

02

If ITAR does not apply, identify the applicable ECCN by searching the BIS SNAP-R Classification database or the CCL itself — Category 3 (Electronics) covers components, sub-assemblies, and test equipment; Category 5 Part 1 (Telecommunications) covers comms hardware; Category 5 Part 2 (Information Security) covers encryption — note that encryption capability in any product, including IoT firmware, triggers a separate EAR classification analysis.

03

If your product carries an ECCN, determine the Reason for Control (NS, AT, EI, etc.) and check whether a licence exception applies for your destination country and end-user — common exceptions include ENC (for encryption items with BIS annual self-classification reporting), LVS (low-value shipments), and GOV (government end-users); exceptions have specific conditions that must be satisfied, not assumed.

04

Screen all customers, consignees, freight forwarders, and end-users against the Consolidated Screening List before every shipment — the CSL is updated frequently, and a party that was clear last month may be added following sanctions action; document every screening check with a date-stamped record retained for five years.

05

Establish and maintain an internal export compliance program (ECP) including written policies, classification records, screening logs, employee training, and an audit function — both DDTC and BIS conduct voluntary disclosure programs that can significantly mitigate penalties for self-reported violations, and an ECP that demonstrates good-faith compliance is the single most important factor in enforcement outcomes.

## Frequently asked questions

### What electronics products fall under ITAR rather than EAR?

ITAR applies to electronics that are specifically designed, modified, or configured for a defense or military application listed in the USML. Examples include electronics for weapons guidance systems (Category VII), military radar and jamming equipment (Category XI), military communications systems (Category XI), space systems with national security applications (Category XV), and nuclear weapons-related electronics (Category XVI). Commercial electronics — even those sold to military customers — are generally EAR-controlled unless they were specifically designed for a defense function. The test is design purpose, not the identity of the buyer.

### What is EAR99 and does it mean no export controls apply?

EAR99 is the classification for items subject to EAR that are not listed on the Commerce Control List. EAR99 items generally do not require an export licence for most destinations and most end-users. However, EAR99 does not mean unrestricted export — all EAR99 shipments must still be screened against the restricted party lists (Entity List, Denied Persons List, OFAC SDN, State Debarred), and exports to embargoed countries require an Office of Foreign Assets Control (OFAC) licence regardless of ECCN classification. A product being EAR99 is not a compliance end-state; it is a classification that reduces but does not eliminate export control obligations.

### How do encryption capabilities affect EAR classification?

Any product that incorporates encryption functionality — including Wi-Fi, Bluetooth, TLS, AES in firmware, or any cryptographic algorithm — is subject to additional EAR classification analysis under ECCN 5E002 or 5D002 for software and technology, or 5A002 for hardware. Many commercial encryption products qualify for licence exception ENC, which permits export to most destinations without a prior licence but requires an annual self-classification report filed with BIS and the NSA. Failing to classify and report encryption-capable products under ENC is one of the most common EAR compliance gaps among IoT and connected hardware companies.

### What are the penalties for ITAR or EAR violations?

ITAR criminal penalties can reach $1 million per violation and 20 years imprisonment; civil penalties up to $1.4 million per violation. DDTC has pursued multi-million dollar consent agreements against major aerospace and defense contractors for systemic ITAR compliance failures. EAR criminal penalties reach $1 million per violation and 20 years imprisonment; civil penalties up to $364,992 per violation or twice the transaction value, whichever is greater. BIS has significantly increased enforcement activity for technology exports to Russia and China following recent geopolitical developments. Voluntary self-disclosure, a robust ECP, and prompt remediation are the primary mitigation factors in enforcement outcomes.

**Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions.

🇺🇸 US roadmap for your product

Every standard, document, and test that applies — free, no account required.

See your free roadmap[

Want an expert to take your product through 🇺🇸 US compliance for you?

One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts.

See compliance services](/services)

Related guides

*   [FCC Part 15 Subpart B EmissionsFCC Part 15 Subpart B EMC emission rules for unintentional radiators: Class A vs Class B limits, ANSI C63.4 measurement, SDoC vs certification, and EU EN 55032 compatibility.](/guides/fcc-part-15-subpart-b-emissions)
*   [US Section 301 TariffsUS Section 301 tariffs on Chinese electronics: List 1–4A rate structure, 2024 USTR rate increases, the exclusion process, and country-of-origin strategies for reducing exposure.](/guides/us-section-301-tariffs-electronics)
*   [CPSC SaferProducts ReportingCPSC Section 15(b) mandatory reporting: the 24-hour window, SaferProducts.gov, corrective action plans, and how to build an internal safety incident monitoring programme.](/guides/cpsc-safer-products-reporting)
*   [India Foreign Trade Policy 2023India Foreign Trade Policy 2023: IEC registration with DGFT, ICEGATE customs linkage, ITC(HS) import classification, Advance Authorisation for duty-free inputs, and SIMS import monitoring.](/guides/india-foreign-trade-policy-2023)