A technology company based in the United States hires a senior engineer from a country subject to broad OFAC-administered controls. The engineer will work in the domestic facility, touching controlled source code and production data daily. No goods leave the building. Yet the company may have just conducted an export. Meanwhile, its European parent shares the same technical documentation with the same engineer through a shared server based in Germany. Under EU dual-use rules, the analysis is meaningfully different – and the gap between the two regimes is exactly where cross-border businesses suffer their most expensive compliance failures.
A deemed export (the legal fiction treating a release of controlled technology or source code to a foreign national in the United States as an export to that person's home country) arises under the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS). The EU equivalent, the release of controlled technology to a non-EU national inside the EU, operates under the EU dual-use rules but applies a materially different nationality test and classification standard. As of April 2026, the two regimes share a common underlying logic but diverge significantly in trigger conditions, nationality analysis, and licensing routes – divergences that routinely catch cross-border groups by surprise.
This analysis sets out how the deemed-export concept operates under each regime, where the tests diverge, what that divergence means for a multinational with employees in multiple jurisdictions, and when the risk profile shifts from manageable to urgent.
What is a deemed export and why does it matter for US-based operations?
Under the EAR, a deemed export occurs when controlled technology or source code is released to a foreign national inside the United States, triggering a licence requirement as though the item were physically shipped to that person's country of nationality. The governing authority is BIS, and the instrument is the EAR. The deemed-export mechanism exists because restricting physical shipments while allowing unrestricted access to the underlying technical knowledge in a domestic setting would hollow out the control entirely.
The practical significance is substantial. A research university, a defence-adjacent manufacturer, or a software company with a diverse technical workforce faces deemed-export exposure every time a foreign-national employee accesses Export Control Classification Number (ECCN) – classified technology above the EAR99 baseline. ECCN classification is the first gate. If the technology has no ECCN and is classified as EAR99, no deemed-export licence is ordinarily required regardless of nationality. If it carries an ECCN with a licence requirement for the employee's country of nationality, the company must either hold a licence, qualify for an applicable licence exception, or restrict access.
In our experience, companies underestimate the scope of what constitutes a "release." Verbal disclosure in a meeting, visual inspection of a controlled process, and access to an encrypted repository on a corporate server can each constitute a release. The question is not whether information was transmitted externally but whether a foreign national obtained access to the controlled technology. Have you audited every touchpoint – not just the export-control documentation that goes out the door?
A further complication is dual nationality. BIS's position on dual nationals is that where a person holds nationality of both a country requiring a licence and the United States or a permissive country, the more restrictive nationality governs for deemed-export purposes. This is a point of genuine legal complexity and one where the consequences of getting it wrong are serious.
How does the EU approach technology transfer to non-EU nationals?
The EU dual-use rules establish a parallel concept – often called an "intra-EU transfer" or a "deemed transfer" in practitioner shorthand – but the architecture is different. Under the applicable EU dual-use instrument, the transfer of controlled technology to a person outside the EU, or in certain circumstances to a non-EU national within the EU, can require an authorisation. The EU system turns on the EU dual-use list (the EU equivalent of the Commerce Control List) and the classification of the technology against that list.
The critical structural difference is that the EU regime is administered at member-state level for most authorisations. There is no single EU-wide deemed-export licence in the way that BIS issues a single US licence. A company operating in France, Germany, and the Netherlands may need to engage three separate national competent authorities if it seeks an authorisation covering technology transfers from each jurisdiction. This fragmentation creates a co-ordination burden that is easy to underestimate when planning a cross-border technology-sharing arrangement.
The nationality test also differs. The EU framework does not apply a "country of most restrictive nationality" rule in the same mechanical way as BIS. Practitioner experience indicates that EU competent authorities tend to focus on the destination of the technology if it is ultimately re-transferred, rather than solely on the passport held by the receiving individual. This produces different compliance obligations for the same underlying fact pattern – and a company that designs its programme around the US rule alone will have gaps on the EU side.
We regularly advise multinational groups that maintain shared technical repositories across US and EU entities. The access-control design that satisfies BIS's deemed-export requirements may not, without further adaptation, satisfy the relevant EU member-state authority. The two analyses must run in parallel, not sequentially.
Where do the regimes diverge most sharply – and what do businesses miss?
The sharpest divergences between the US EAR deemed-export regime and the EU dual-use technology-transfer rules fall into four areas, each of which generates a recurring category of compliance failure in cross-border groups.
Classification discordance. An item classified under a specific ECCN on the US Commerce Control List may map to a different control entry – or no controlled entry – on the EU dual-use list. The two lists are aligned on many dual-use categories, but the alignment is imperfect and the gaps matter. A company that screens technology solely against the US CCL and assumes equivalence with the EU list will have blind spots. Classification must be run against both lists independently.
The licence-exception architecture. BIS offers a suite of licence exceptions – including exceptions for technology transfers to employees of US-incorporated companies and, in limited circumstances, for access by foreign-national employees holding certain immigration statuses. The EU has no direct equivalent of the employment-based US licence exceptions. This means that a company relying on a US licence exception to authorise technology access by a foreign-national employee needs to assess separately whether any EU authorisation route is available for the same access from the EU side of the group.
Notification and record-keeping obligations. Both regimes impose record-keeping requirements, but the triggers and retention periods differ. Under the EAR, export records must generally be retained for five years from the date of export or, in some cases, five years from the date of any transaction to which they relate. Verify the current EU member-state requirements separately – they vary and some exceed the US baseline.
Enforcement posture and voluntary disclosure. BIS operates a formal voluntary self-disclosure (VSD) programme under which a company that identifies and self-reports a deemed-export violation can expect that disclosure to be treated as a mitigating factor in any penalty calculation. The EU member-state competent authorities do not apply a uniform VSD regime. Some have formal processes; others treat self-reporting as relevant mitigation without a defined procedure. Getting the self-disclosure strategy right in a cross-border enforcement situation requires advice calibrated to both the US and the relevant EU jurisdiction simultaneously.
What is the risk profile for a group operating across both regimes?
A group with US and EU operations sharing technology across jurisdictions faces a layered risk profile that is greater than the sum of the two individual exposures. The reason is that a failure in one jurisdiction can trigger scrutiny in the other. A BIS investigation that surfaces a pattern of unlicensed deemed exports may reveal that the same technology was shared through an EU entity in a manner that raises questions for the relevant EU member-state authority. The two regulators do not formally co-ordinate enforcement, but the factual record uncovered in one investigation travels.
The penalty exposure on the US side is significant. BIS civil penalties for EAR violations can reach substantial per-transaction amounts, and criminal exposure exists for wilful violations. On the EU side, penalties are set by member-state law and vary considerably – from administrative fines to criminal prosecution for the most serious breaches.
In a recent matter, a software group with development teams in both the United States and a major EU member state identified, during an internal audit, that source code classified under an ECCN was accessible to a cohort of engineers holding nationalities of countries requiring a BIS licence. The same code was accessible from the EU entity's repository to some of the same engineers. We assessed the BIS exposure, scoped the EU dimension with reference to the applicable member-state competent authority, structured a dual-track disclosure and remediation plan, and assisted the group in implementing access controls that satisfied both regimes. The matter resolved without formal enforcement proceedings.
What creates the acute risk is inaction after discovery. A company that identifies a potential deemed-export issue and delays assessment extends the period of potential violation, weakens the VSD narrative, and reduces the options available. Is your organisation equipped to recognise a deemed-export trigger when it arises?
The position above covers the standard cross-border pattern. Your facts – the specific technology, the nationalities of the employees involved, the structure of the group, and the jurisdictions of the operating entities – change the analysis materially. Early advice is disproportionately valuable compared with advice sought after a compliance failure has crystallised.
If your business is reviewing technology-access controls or has identified a potential deemed-export exposure, contact Calder & Vance at info@caldervance.com for an initial assessment.
How does OFAC's role interact with BIS in US technology-transfer cases?
OFAC and BIS operate distinct legal regimes with different legal bases, different prohibitions, and different enforcement mechanisms – but in technology-transfer cases they can overlap in ways that multiply the compliance burden on a single transaction or employment relationship.
BIS controls the export and deemed export of dual-use and certain other technology through the EAR. OFAC administers economic sanctions programmes that prohibit transactions with designated persons and countries subject to comprehensive or targeted sanctions. The two regimes interact when a foreign-national employee, a technology recipient, or an end user is also a person subject to OFAC sanctions – either because they are individually designated or because they are a national of a country subject to a comprehensive OFAC programme.
In practice, this means that the screening obligation in a deemed-export context is not limited to BIS nationality analysis. A company must also screen the relevant foreign national against OFAC's Specially Designated Nationals list (SDN List – OFAC's list of blocked persons and entities) and the other OFAC lists. A foreign-national employee who does not trigger a BIS deemed-export licence requirement may nonetheless be a designated person whose employment itself raises an OFAC question. The two screenings are conceptually distinct and must both be conducted.
We have acted for clients who structured a technically compliant BIS deemed-export analysis and overlooked the OFAC dimension entirely. The two agencies have different enforcement postures and different penalty regimes. Running one analysis without the other is a structural gap in the compliance programme.
If a transaction has already been flagged, or a potential OFAC issue has surfaced in the context of a technology-transfer review, early engagement with counsel preserves the options – including the option of a voluntary self-disclosure that may meaningfully affect the enforcement outcome. Contact us at info@caldervance.com to discuss your situation confidentially.
Common risk flags and compliance failures in deemed-export programmes
The most common risk flags in deemed-export compliance are predictable, recurring, and largely avoidable with the right programme design. In our cross-border practice, we see the same patterns across different sectors and group structures.
EAR99 over-reliance. Companies that classify broad categories of technology as EAR99 without conducting a proper commodity jurisdiction or ECCN classification analysis are exposed. EAR99 status is not a default; it is a conclusion that requires analysis. Assumptions rather than analysis create gaps.
Failure to maintain nationality records for the foreign-national workforce is the second most common failure. A company cannot run a deemed-export analysis it has not been designed to do. If HR systems do not capture nationality data in a form accessible to the export-control team, the compliance programme cannot function.
Inadequate access controls are a related failure. A company that holds a BIS deemed-export licence or relies on a licence exception must implement access controls that limit technology access to the persons covered by the licence or exception. Generic network access for all employees defeats the purpose of the licence. The access-control architecture must map to the licence conditions.
On the EU side, the equivalent failure is assuming that the US-compliant programme transfers automatically. It does not. EU member-state competent authorities apply their own classification lists, their own nationality and re-transfer analysis, and their own authorisation requirements. A programme designed solely around BIS requirements will have structural gaps for operations in EU jurisdictions.
Finally, the interaction between deemed-export obligations and immigration processes is underappreciated. The grant of an immigration status does not carry with it any export-control authorisation. A company that interprets a work authorisation as also authorising technology access has conflated two distinct legal regimes.
Related practices
- BIS EAR deemed export advisory service – classification, licence applications, access-control design, and ongoing compliance support under the EAR.
- Deemed exports: OFSI vs Australia – a comparative analysis – how the UK and Australian technology-transfer regimes compare for cross-border groups.
When should a business involve specialist export-control counsel?
Specialist export-control counsel adds the most value at three points in the lifecycle of a deemed-export issue: at programme design, at trigger-event identification, and at enforcement response.
At programme design, counsel can conduct the ECCN classification analysis that is the foundation of the programme, map the foreign-national workforce against the BIS and OFAC databases and against the EU dual-use list, draft the access-control policy that satisfies BIS licence conditions or exception requirements, and identify the EU member-state authorisations that the EU-side programme requires. Getting this right at the outset is substantially cheaper than remediation.
At trigger-event identification – when an internal audit, a transaction review, or an employee-onboarding process surfaces a potential deemed-export issue – counsel can scope the apparent violation, assess the BIS and OFAC exposure simultaneously, advise on voluntary self-disclosure in the US context, and engage with the relevant EU competent authority where the EU dimension exists.
At enforcement response, the priorities are preserving documentation, avoiding obstruction, and presenting the compliance-programme evidence and VSD narrative in the most effective form. The BIS civil penalty process allows for a submission that addresses the factors relevant to the penalty calculation; preparation of that submission requires practitioner familiarity with BIS enforcement practice.
A common myth among in-house compliance teams is that the deemed-export analysis is a one-time exercise completed at the point of hire. It is not. Nationality can change, technology classifications change as the control lists are updated, and access patterns change as an employee's role evolves. The programme must be designed as a continuous obligation, not a point-in-time clearance.
Our practice provides classification analysis, licence application preparation and management of BIS queries, access-control design, EU dual-use programme review, and enforcement defence in dual-regime deemed-export matters. To stress-test your screening and compliance programme, reach our team at info@caldervance.com.