INTERNATIONAL TRADE LAW
Encryption Export Controls Under the EAR
If your product contains encryption, assume it is export-controlled until you have classified it — most encryption items fall under Category 5, Part 2 of the Commerce Control List. That does not mean you need an individual license for every shipment. It means you have to classify the item, decide whether License Exception ENC or mass-market treatment lets you export it without a license, and meet any reporting that comes with that authorization. This is one of the more technical corners of the Export Administration Regulations (EAR), and the rules are administered by the Bureau of Industry and Security (BIS).
Where encryption lives in the EAR
Encryption is controlled because the same technology that secures legitimate communications can shield hostile ones. Rather than ban it, the EAR channels most commercial encryption through a system that allows wide export under conditions. Encryption items sit in Category 5, Part 2 (Information Security) of the Commerce Control List. The ECCNs you will see most often are:
| ECCN | What it covers |
|---|---|
| 5A002 | Information-security systems, equipment, and components (“standard” controlled encryption) |
| 5D002 | Software performing or enabling those functions |
| 5E002 | Technology for the development, production, or use of 5A002/5D002 items |
| 5A992 / 5D992 | Items that meet the “mass market” criteria, decontrolled to a lighter level |
The reason for control on most of these items is national security and anti-terrorism. Because nearly every modern device — phones, routers, laptops, business software — uses encryption, this category sweeps in a huge amount of ordinary commercial product. That is exactly why License Exception ENC and the mass-market rules exist.
License Exception ENC and mass-market treatment
License Exception ENC (Section 740.17 of the EAR) is the workhorse. It authorizes the export and reexport of many encryption items, to most destinations, without an individual license — subject to conditions tied to the item, the destination, and the end user. A small set of destinations (the EAR’s most heavily embargoed countries) are carved out entirely.
The mass-market provisions (Note 3 to Category 5, Part 2) move widely available, retail-style encryption products to ECCN 5A992 or 5D992, a lighter control level, again subject to the same kind of review or self-classification step. Whether an item qualifies as mass market turns on how it is sold and whether its cryptographic functionality can be easily changed by the user — not on a single key-length number.
The practical takeaway: most companies do not file individual license applications for encryption. They classify the product, confirm it qualifies for ENC or mass-market treatment, and then satisfy the classification and reporting steps that come attached.
Classification and reporting: the step people miss
Getting to “no license required” usually still requires a paperwork step, and this is where exporters slip up:
- Some items must be reviewed by BIS. Certain stronger encryption items require a classification request to BIS before you can rely on the exception; BIS reviews encryption submissions through its ENC Encryption Request Coordinator. Until you have that classification, you cannot assume the lighter treatment.
- Some items can be self-classified — but get reported. Other items may be self-classified, but you must file an annual self-classification report with BIS listing them.
- Certain items carry semi-annual sales reporting. For some categories of ENC-eligible items, exporters must file a semi-annual report of sales to certain destinations.
Skipping the classification request, the annual self-classification report, or the semi-annual sales report is a compliance failure even when the underlying export would have been perfectly lawful. Build these filings into your calendar.
A short workflow for an encrypted product
- Determine whether the item performs or relies on cryptography that meets the Category 5, Part 2 thresholds. If it does not, it is likely outside these controls.
- Classify it — 5A002/5D002/5E002, or mass-market 5A992/5D992 — using the item’s actual cryptographic functionality. See our ECCN classification checklist.
- Check ENC and mass-market eligibility against the destination and end user, and confirm whether a BIS classification request is required first.
- Screen for end-use and end-user problems. Encryption authorizations do not override the EAR’s end-use and end-user controls or sanctions.
- Calendar the reports — annual self-classification and any semi-annual sales reporting — and keep your classification record for five years.
Why it is worth getting right
Because encryption is so widely embedded, it is easy to ship a controlled item to a destination or party it should not reach without ever realizing the product was controlled. The penalties are the standard EAR penalties and they are steep: criminal violations under the Export Control Reform Act can reach up to 20 years in prison and $1 million per violation, and the maximum civil penalty — adjusted annually for inflation — exceeded $370,000 per violation or twice the transaction value as of early 2025. Because the encryption rules are revised periodically, confirm the current text of Section 740.17 and Category 5, Part 2 before relying on a classification done in a prior year.
Frequently asked questions
Is all encryption export-controlled? Most products that perform or rely on encryption fall under Category 5, Part 2 of the Commerce Control List. Whether you need a license is a separate question — License Exception ENC and mass-market treatment let most of them ship without one.
What is License Exception ENC? A provision in Section 740.17 of the EAR that authorizes export of many encryption items to most destinations without an individual license, subject to conditions and, for some items, a BIS classification request and reporting.
Do I need a license to export a laptop or phone with standard encryption? Usually no — these typically qualify as mass-market items or move under License Exception ENC. But you still have to classify them and meet any applicable reporting, and you still cannot ship to an embargoed destination or prohibited end user.
What reporting comes with encryption exports? Depending on the item, an annual self-classification report and, for some categories, a semi-annual sales report — plus keeping your classification documentation on file.
Shipping a product that contains encryption? Reidel Law Firm delivers a flat-fee Import/Export Compliance Memo that settles classification, License Exception ENC eligibility, and reporting — with direct attorney access. Get a flat-fee compliance memo →
