Exporting Software & Technology: U.S. Controls

To export software or technology from the U.S. legally, you must first classify it under the Export Administration Regulations (EAR), then confirm whether your specific item, destination, end user, and end use require a license. Most commercial software needs no license to most countries — but “most” is doing a lot of work in that sentence. Encryption, “dual-use” capability, and the rule that sharing code with a foreign colleague inside the U.S. can itself be an export are where companies get caught.

This guide covers the framework. Because controls in this area change frequently, treat any specific classification as something to confirm against the current Commerce Control List before each shipment.

Step 1: Figure out which regulations govern your item

Two regimes split most technology exports:

• The EAR (15 CFR Parts 730–774), administered by the Bureau of Industry and Security (BIS), covers commercial and “dual-use” software and technology — items with both civilian and potential military or proliferation uses.
• The ITAR (22 CFR Parts 120–130), administered by the State Department’s Directorate of Defense Trade Controls (DDTC), covers defense articles and defense-related technical data on the U.S. Munitions List.

If your software was designed for or modified for a military application, assume ITAR until proven otherwise. Everything else is an EAR analysis.

Step 2: Classify the item (ECCN or EAR99)

Under the EAR, every item has an export classification. You are looking for one of two answers:

• An Export Control Classification Number (ECCN) — a five-character code on the Commerce Control List that ties your item to specific reasons for control (national security, encryption, missile technology, and so on).
• EAR99 — the residual category for items subject to the EAR but not listed with an ECCN. Most ordinary commerc