Navigating U.S. Export Controls: Your Guide to ITAR and EAR for 2026

An aerospace engineer in Texas emails a schematic for a satellite part to a partner in Germany. A simple click. But that component is controlled under U.S. law. Unbeknownst to them, this single email has just triggered a potential federal investigation, multi-million dollar fines, and the risk of being barred from all future exports.

U.S. export controls are a web of federal regulations governing how goods, tech, and services leave the United States. It’s not intuitive. The system is split into two main regimes: the International Traffic in Arms Regulations (ITAR) for military items and the Export Administration Regulations (EAR) for commercial or “dual-use” items. Compliance is mandatory. Violations carry severe civil and criminal penalties.

Export Controls – Government regulations that restrict the transfer of specific items, software, technology, and services to foreign destinations, entities, and individuals for national security, foreign policy, and non-proliferation reasons.

Defense Articles – Any item or technical data designated on the ITAR’s U.S. Munitions List (USML), specifically designed or modified for a military application. This includes components, parts, and accessories.

Dual-Use Items – Items that have both commercial and potential military or proliferation applications, controlled under the EAR. Examples include high-performance computers, certain sensors, and advanced materials.

Key Takeaways

• Two Worlds of Compliance: U.S. export law is split between ITAR (run by the State Department for military gear) and EAR (run by the Commerce Department for “dual-use” items).
• ITAR is Unforgiving: If your product is on the U.S. Munitions List (USML), you’re in the ITAR world. Your company *must* register with the DDTC under 22 CFR § 122.1, even before you export anything. This isn’t just a suggestion; it’s a foundational requirement.
• EAR is Broader: This regime controls a vast range of “dual-use” items on its Commerce Control List (CCL). While many items don’t need a license (“NLR”), a license might still be required depending on the product’s destination, its intended user, or how it will be used.
• Penalties Are Staggering: A single violation can trigger fines over $1 million, jail time of up to 20 years, and debarment—the corporate death penalty of being banned from exporting.
• The Rules Follow the Goods: U.S. controls don’t stop at the border. They apply to re-exports of U.S. items by foreign companies, and investigations can pull in international bodies like Interpol.

What Exactly Are U.S. Export Controls?

U.S. export controls are federal laws built to protect national security and execute foreign policy. They aren’t just about shipping boxes. They work by regulating the transfer of sensitive goods, software, and Technical Data to foreign nationals, who could be across the ocean or across the cubicle. The definition of “export” is shockingly broad, covering electronic data, technical help, and even simple conversations.

Think of the system as resting on two main pillars, each managed by a different government department:

1. International Traffic in Arms Regulations (ITAR): Run by the Department of State, ITAR controls the export of items and services built specifically for war.
2. Export Administration Regulations (EAR): Run by the Department of Commerce, EAR casts a wider net over “dual-use” items—things with everyday commercial functions but also potential military applications.

These regulations create a complex system of Restrictive Measures that affect industries from aerospace and defense to biotech and academic research. They also operate in concert with economic Sanctions programs, like those from the Office of Foreign Assets Control (OFAC), which target specific countries, groups, and individuals.

What is ITAR and Who Needs to Worry About It?

The International Traffic in Arms Regulations (ITAR) is the government’s tight leash on Defense Articles and Defense Services. Administered by the State Department’s Directorate of Defense Trade Controls (DDTC), its sole purpose is to keep sensitive military technology out of the wrong hands.

Everything ITAR controls is found on the U.S. Munitions List (USML). If you manufacture, export, or even act as a Brokering agent for items on this list, you have a critical first step. As stated in 22 CFR § 122.1, your company absolutely must register with the DDTC. Failing to register *before* you start manufacturing or brokering is a foundational violation, not a simple paperwork error you can fix later.

Many people mistakenly believe ITAR only covers tanks and missiles. Not true. The rules reach deep into components, spare parts, and, most importantly, the Technical Data and defense services tied to them. Codified at 22 CFR part 120 et seq., the law is clear: emailing an unencrypted blueprint of a controlled part to a foreign person is an export violation as serious as shipping the physical item without a license.

What is the difference between ITAR and EAR?

The core distinction is what’s being controlled and which agency is doing the controlling.

Bottom line: If an item was designed or changed for a military purpose, it’s almost certainly ITAR. If it’s a commercial product that could also be used for a military or strategic end, it probably falls under the EAR.

How Does the EAR Control “Dual-Use” Items?

The Export Administration Regulations (EAR) fall under the Department of Commerce’s Bureau of Industry and Security (BIS). These regulations oversee a vast universe of goods, software, and technology not covered by ITAR, most famously the Dual-Use Items.

At the center of the EAR is the Commerce Control List (CCL). Each item on this list gets an Export Control Classification Number (ECCN), a code that outlines the specific licensing rules. To see if you need an Export Authorization, you have to cross-reference the ECCN with the Commerce Country Chart for your product’s destination.

Plenty of commercial items are designated “EAR99″—subject to the EAR but not special enough to be on the CCL. For most destinations, these items don’t require a license. Here’s the catch: Catch-all Controls. An EAR99 item absolutely requires a license if you know, or even have reason to suspect, it’s headed to a prohibited end-user, a prohibited end-use (like weapons development), or a country under a full embargo. These rules exist to prevent the Circumvention of export laws by clever routing.

What is subject to EAR?

The EAR’s jurisdiction is massive. It covers:

• All items currently inside the United States.
• All items of U.S. origin, no matter where they are in the world.
• Products made abroad that contain more than a small, or de minimis, amount of controlled U.S. content. The threshold for this “de minimis” level can be as low as 10% for certain countries, creating a compliance trap for foreign manufacturers.
• Certain foreign-made items that are the direct product of U.S. technology or software.

Examples of controlled items include high-performance computers, advanced navigation systems, specific types of encryption software, certain machine tools, and even some biological agents.

What Does Practical Compliance with ITAR and EAR Look Like?

An export compliance program isn’t a “nice-to-have.” For any company in these sectors, it’s a core business function. The essential steps are:

1. Jurisdiction & Classification: First, you must determine if your product, tech, or service falls under ITAR, EAR, or neither. This isn’t a step for wishful thinking; incorrectly classifying an item as “EAR99” to avoid licensing is a red flag for investigators. If it is controlled, you have to assign the correct USML Category or ECCN.
2. Party Screening: Every single party to a transaction—buyer, consignee, end-user—must be checked against the U.S. Government’s various restricted party lists. A sale to someone on the Specially Designated Nationals (SDN) List is a grave violation. Expert help with is often critical here.
3. License Determination: Based on the classification, destination, and parties involved, you have to figure out if you need an Export Authorization (a license or an applicable exception/exemption).
4. Record-Keeping: Both ITAR and EAR require you to keep meticulous records for at least five years after the transaction is complete. These must be ready for government inspection at a moment’s notice. Missing records are a violation in themselves.

If your company finds a potential violation, you can submit a voluntary disclosure. While it doesn’t guarantee a free pass, a thorough and honest disclosure is a powerful mitigating factor. It is always better than waiting for the government to find it for you. The potential from an enforcement action can cripple a business.

What is an example of an ITAR violation?

A classic case is a U.S. company selling a rifle scope from the USML to a customer in a friendly country without getting the required DDTC export license first. A more subtle, and common, violation involves a university research lab. If that lab, working on a defense-funded project, lets a foreign graduate student access ITAR-controlled Technical Data without authorization, it has committed a “deemed export” violation.

What is the penalty for violating ITAR?

The consequences for ITAR violations are among the harshest in federal law.

• Civil Penalties: Fines can reach a staggering $1.2 million for each violation, a figure that’s regularly adjusted for inflation. A single unauthorized shipment with multiple controlled items could lead to millions in penalties.
• Criminal Penalties: If a violation is willful, the consequences escalate dramatically. Individuals can face up to 20 years in prison, personal fines up to $1 million, or both.
• Debarment: The State Department can simply ban a company or person from exporting defense items. This isn’t just a penalty; for many businesses, it’s a corporate death sentence that cuts them off from the global market.

What Happens When Export Controls Go International?

Don’t assume these investigations stop at the U.S. border. They don’t. The Department of Justice works with foreign partners to pursue individuals and companies abroad, especially in cases involving the re-export of American goods or complex Circumvention schemes designed to hide the final destination.

One powerful tool in their arsenal is Interpol. While Interpol’s constitution, specifically Article 2, is built on mutual police assistance, it contains a critical firewall. Article 3 of its Constitution strictly forbids the organization from getting involved in activities of a political, military, religious, or racial nature.

This is a crucial defense. Why? Because a country could try to weaponize an Interpol Red Notice, targeting a business rival or a political dissident under the pretense of an export control violation. If the “crime” isn’t a universally recognized offense but a breach of one country’s unique, politically charged controls—like certain—the Red Notice itself can be challenged as a violation of Article 3. An individual targeted this way can fight back by filing a request with the Commission for the Control of Interpol’s Files (CCF) to access and delete the data, a process governed by Interpol’s Rules on the Processing of Data.

This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organization, or official authority.