How to Comply With ITAR: A Practical Guide

ITAR compliance starts with one question: is your product, service, or data on the U.S. Munitions List? The International Traffic in Arms Regulations (ITAR) control the export of defense articles and defense services, and they are administered by the Directorate of Defense Trade Controls (DDTC) at the U.S. Department of State. If what you make or know is on that list, registration and licensing obligations attach before anything crosses a border — and, in some cases, before anything is exported at all.

What ITAR Controls

ITAR governs three things, all tied to the U.S. Munitions List (USML):

• Defense articles — physical items on the USML, from firearms and ammunition to military aircraft, spacecraft, and their specially designed parts and components.
• Defense services — assistance to a foreign person in the design, development, manufacture, testing, or use of a defense article, including training.
• Technical data — information required to design, produce, or use a defense article, such as blueprints, specifications, and documentation.

The USML is organized into 21 categories. The distinction that matters most: items that are inherently military live here under ITAR, while dual-use items with both commercial and military applications live on the Commerce Control List under the EAR. One of your first compliance jobs is deciding which regime your product falls under, because the rules and the agency differ completely.

Who Must Register With DDTC

This is the requirement most companies underestimate. Any U.S. person who manufactures, exports, or temporarily imports defense articles, or furnishes defense services, must register with DDTC — and that includes manufacturers who never export. Making a USML item domestically is enough to trigger the registration obligation on its own.

Registration is not a license to export; it is a prerequisite to applying for one, and it is how the government keeps a census of the defense industrial base. DDTC charges a tiered annual registration fee (starting at $3,000 per year for the base tier as of 2025, with higher tiers for companies that file more authorizations). Because those amounts are set by regulation and revised periodically, confirm the current fee on the DDTC website before you budget.

ITAR Has Extraterritorial Reach

ITAR follows the article and the U.S. person, not the border. A U.S. company or individual involved in exporting or transferring defense articles, services, or technical data must comply regardless of where they are physically located. Equally important, re-exports and retransfers of ITAR-controlled items by foreign parties downstream still require U.S. authorization. Selling to an approved foreign customer does not free that customer to pass the item along.

The Deemed Export Trap

As with the EAR, releasing ITAR technical data to a foreign person inside the United States — a foreign-national employee, contractor, or visitor — is treated as an export to that person’s country and generally requires authorization. Many ITAR problems are not shipments at all; they are foreign nationals gaining access to controlled drawings, software, or know-how without a license in place.

Core Compliance Steps

A workable ITAR compliance program comes down to a handful of disciplines:

Why Compliance Is Worth the Discipline

ITAR enforcement is among the most aggressive in U.S. trade law. Violations can bring substantial civil penalties per violation (adjusted annually for inflation and reaching well over $1 million), criminal penalties including imprisonment, seizure of goods, and debarment — loss of the right to participate in defense trade at all. For a company whose business is defense work, debarment can be existential. The penalty framework is covered in more depth in our guide to export-control penalties.

Frequently Asked Questions

What is the difference between ITAR and the EAR?

ITAR controls inherently military items on the U.S. Munitions List and is administered by the State Department’s DDTC. The EAR controls dual-use items on the Commerce Control List and is administered by Commerce’s BIS. Determining which applies to your product is the threshold question.

Do I have to register with DDTC even if I never export?

Yes, if you manufacture defense articles or furnish defense services. The registration requirement is triggered by manufacturing USML items domestically, not only by exporting them.

What counts as technical data under ITAR?

Information required for the design, development, production, or use of a defense article — drawings, specifications, documentation, and similar know-how. Releasing it to a foreign person, even within the United States, is generally an export.

How do I know if my product is on the USML?

Compare it against the 21 USML categories. When the answer is unclear — common for parts and components — you can request a commodity jurisdiction determination from DDTC, which formally decides whether the item is ITAR- or EAR-controlled.

Defense trade leaves no room for “we’ll fix it later.” Reidel Law Firm helps companies determine jurisdiction, register with DDTC, structure agreements, and build ITAR compliance programs on flat-fee terms. Get an import/export compliance memo.