A precision-component manufacturer in Germany signs a supply agreement with a distributor in Singapore. The goods carry no Export Control Classification Number (ECCN – a US Commerce Control List identifier for controlled items) and the US exporter's compliance team has classified them as EAR99 (the residual category under the Export Administration Regulations, covering items subject to the EAR but not listed on the Commerce Control List). The transaction looks clean. Then the EU legal team flags that the same items may require authorisation under the EU dual-use regime. Both teams are right – and both teams are talking about different legal tests. That divergence is the precise risk this analysis addresses.
As of April 2026, an EAR99 determination under the US Bureau of Industry and Security regime confirms only that an item does not appear on the US Commerce Control List at a specific ECCN. It does not confer clearance under the EU dual-use rules, the UK Export Control Order, or any other national regime. The two systems use different classification architectures, different catch-all controls, and different end-use triggers. A cross-border business that relies on a single-regime determination is exposed on the other side of the transaction.
This analysis maps the two systems criterion by criterion, identifies the points of divergence that most frequently surprise exporters, and sets out what a business operating across both regimes should do before it ships.
What is an EAR99 determination, and what does it actually confirm?
An EAR99 determination confirms that an item is subject to the Export Administration Regulations administered by BIS (the Bureau of Industry and Security) but does not fall within any ECCN on the Commerce Control List. The determination is the output of a classification exercise, not a licence or a clearance. It tells the exporter that no validated export licence is required for the item under the EAR – unless an end-use or end-user control applies independently.
The classification path runs in two directions. A company may self-classify, applying BIS's published commodity descriptions and notes to reach EAR99. Alternatively, it may submit a Classification Request to BIS, which issues a formal commodity classification. In our experience, self-classification is common for lower-complexity items, but the absence of a BIS-issued classification leaves the company fully responsible if the determination is later challenged. The formal route provides a documented position that regulators and auditors can inspect.
Two conditions override an EAR99 position and reintroduce licence requirements regardless of classification. First, the end-use controls under the EAR impose licence requirements for items destined for certain prohibited end-uses – chemical, biological, nuclear, or missile applications – even when the item itself carries no ECCN. Second, the Entity List, Denied Persons List, and related BIS restricted-party lists impose restrictions on destinations and recipients that apply irrespective of the item's classification. Neither condition appears on the face of a clean EAR99 finding.
This is the first structural divergence from the EU system: under the EAR, the item classification and the end-use/end-user controls operate as separate legal layers. Under the EU dual-use rules, they are partially integrated into the authorisation architecture. A business that treats EAR99 as the end of the compliance analysis – rather than the beginning – has made the most common mistake in cross-border export compliance.
How does the EU dual-use classification system compare?
The EU dual-use regime, established by the relevant Council Regulation on dual-use items, organises controls through Annex I, a positive list of controlled items that maps closely to the Wassenaar Arrangement, the Nuclear Suppliers Group, and other multilateral control lists. Items not appearing on Annex I are, in principle, not subject to EU-level controls. That sounds like a parallel to EAR99 – but the analogy breaks down in three places.
First, the EU regime contains a general catch-all clause (the "catch-all control") that can require authorisation even for non-listed items when the exporter knows, or has been informed by the competent authority, that the items are or may be intended for use in connection with weapons of mass destruction or certain military end-uses. The catch-all is not theoretical. Competent authorities in several member states have issued end-use notifications to exporters of commercially available items – machine tools, chemicals, electronic components – that would otherwise be uncontrolled. The EAR has its own end-use controls, but the operative legal trigger and the notification mechanism differ, and the two systems do not produce identical outcomes for the same fact pattern.
Second, the EU regime since 2021 operates under a revised regulation (EU Regulation 2021/821, as currently in force, verify before reliance) that introduced a new category of controls for cyber-surveillance items. Items in this category may require authorisation in the EU even where they carry no ECCN or are EAR99 in the US classification. The cyber-surveillance controls have no direct BIS equivalent structured in the same way, creating a genuine gap between the two systems for technology exporters.
Third, member states retain the right to apply national controls beyond Annex I. France, Germany, and the Netherlands, among others, maintain national control lists that supplement the EU regime. An item that is EAR99 and not on Annex I may still require a national licence in the member state of export. This layer is invisible to the EAR classification process entirely.
The practical implication is direct: an EU exporter who has confirmed that an item is EAR99 has done the US part of the work. The EU classification exercise is a separate task with a separate legal architecture. Neither result subsumes the other.
Where do the regimes diverge on EAR99 determinations?
The divergence is structural, not incidental. The five most consequential points of difference are set out below.
Classification architecture. The EAR uses a single, US-administered Commerce Control List with reason-for-control codes that determine licence requirements by destination. The EU uses Annex I, supplemented by member-state national lists. Items at the margin of control may sit differently on the two lists because the multilateral control arrangements on which both are based have been implemented differently in the two jurisdictions.
The technology and software note. Both regimes control technology and software for the development, production, or use of controlled items, but the scope of the notes differs. Under the EAR, technology that is EAR99 is genuinely uncontrolled (absent end-use triggers). Under the EU regime, the technology note in Annex I is construed by member-state authorities with some variation, and the catch-all can capture technology that falls outside the note's literal scope. In our cross-border practice, this gap produces the most frequent surprises for technology companies.
The deemed-export concept. Under the EAR, a deemed export occurs when controlled technology is released to a foreign national within the United States, and a licence may be required. The EU regime does not employ an identical deemed-export construct, though some member states apply analogous controls under their national regulations. For a company with research-and-development facilities in both the US and the EU, the compliance obligation for the same disclosure to the same person may differ substantially between the two systems.
The extraterritorial dimension of the EAR. The EAR can apply to the re-export of items of US origin – or items incorporating US-origin content above the de minimis threshold, or produced using certain US technology or software – even when the exporter is not a US person. This is the foreign direct product rule in its various forms. An EU exporter who has classified an item as not on Annex I may still be re-exporting an item subject to the EAR, requiring a BIS authorisation for certain destinations or recipients. The EU regime contains no equivalent extraterritorial reach over items of EU-origin once they have left EU territory. The asymmetry is significant: EAR99 status as determined by the EU exporter does not resolve US re-export exposure.
End-use and end-user controls. Both regimes operate end-use controls, but the trigger mechanisms differ. Under the EAR, an exporter who has knowledge that an EAR99 item will be used in a prohibited end-use must obtain a licence regardless of classification. Under the EU regime, the catch-all requires either knowledge or an official notification. The BIS knowledge standard and the EU knowledge standard are similarly worded but have been applied differently in practice, and compliance teams should not assume that passing one standard means passing the other.
Which regime is stricter on EAR99 determinations?
Neither regime is uniformly stricter. The answer depends on the item, the destination, the end-use, and the nationality of the parties. For practical purposes, the two regimes interact rather than compete, and a cross-border exporter must satisfy both.
The EAR is broader in one critical dimension: its extraterritorial reach means that foreign exporters of items incorporating US-origin content or produced using US-origin technology may face BIS licence requirements even for items that are uncontrolled under the EU regime. In our experience, EU-based exporters of semiconductor-related equipment and advanced materials regularly discover US re-export obligations that their internal classification processes had not captured, because those processes were designed around Annex I rather than the Commerce Control List.
The EU regime is, in certain respects, more demanding for technology exporters since the introduction of the 2021 regulation's cyber-surveillance controls. Those controls can bite on items that are EAR99 and that EU-member-state authorities have specifically targeted. They also interact with the EU's arms-embargo regulations, creating a combined prohibition that operates independently of the EAR.
The answer to "which is stricter" also changes by destination. For shipments to certain countries, the EAR imposes licence requirements for virtually all items including EAR99, through the destination-specific controls and the entity-level controls. The EU regime may impose different restrictions for the same destination. Where the two regimes diverge on a specific destination, the stricter prohibition governs the party subject to it – and a business with US-person involvement in a transaction is subject to both.
Does your team have visibility over the US-origin content in the items you export from the EU? That question determines whether the EAR classification exercise is your compliance team's problem or someone else's.
Risk flags for cross-border exporters
The most common failure point, in our practice, is the assumption that a single classification exercise covers all regimes. The following situations consistently produce exposure.
Supply-chain sourcing from the US. A company that sources components, technology, or software from the US introduces EAR jurisdiction into its supply chain. Once a BIS-jurisdictional item is incorporated into an end-product, the foreign direct product rule and the de minimis analysis become relevant for every subsequent export. Classification under Annex I does not address this. Businesses that have never considered whether their products contain US-origin content above the applicable threshold are carrying unquantified EAR exposure.
Technology transfers and deemed exports. A multinational with staff in both the US and the EU may be making deemed exports under the EAR every time controlled technology is shared with foreign national employees on US soil. If the technology is subsequently classified as EAR99 following a review, the past transfers may still have been subject to a licence requirement at the time. A proper classification exercise should include a retrospective analysis of whether past transfers were compliant. For a more detailed treatment of deemed-export obligations, see our service page on deemed export and technology controls under BIS / EAR.
The catch-all gap. An exporter who has received a catch-all notification from an EU member-state authority is on notice that certain items require authorisation. That notification does not automatically trigger a BIS licence requirement, but it is strong evidence of end-use concern that should feed back into the exporter's knowledge analysis under the EAR end-use controls. Treating the two notification systems as separate silos creates the risk that knowledge acquired in one jurisdiction is not applied in the other.
Re-export by downstream parties. An EU exporter that sells EAR99 goods to a distributor in a third country has limited visibility over the distributor's onward movements. If those goods are of US-origin or incorporate US-origin content, the downstream re-export may require BIS authorisation. The exporter's EAR99 determination does not bind the downstream party's re-export analysis, and it does not protect the exporter from scrutiny if they had knowledge of the onward movement.
Mergers, acquisitions, and restructuring. When a business acquires a target with a legacy classification programme, the inherited EAR99 determinations reflect the target's prior analysis. Product development, sourcing changes, or new end-markets since the last classification review may have changed the correct answer. An EAR99 finding from five years ago may not reflect the current product specification or the current regulatory environment, particularly given the pace of BIS rule-making since 2022.
What should a cross-border business do about EAR99 determinations?
The starting point is to treat EAR99 as a US determination that answers a US question – nothing more. The compliance obligation is to run a parallel determination under the EU dual-use rules (and, where relevant, under the UK Export Control Order and applicable member-state national lists) and to assess the two results together.
A practical classification programme for cross-border businesses should include the following elements.
- US origin-content analysis. Before classifying a finished product, map whether it incorporates US-origin components, uses US-origin technology in production, or was developed using US-origin software. This determines the extent of EAR jurisdiction over the product and its downstream movements.
- Parallel classification under both systems. The EAR and EU classification exercises should be run against the same product by analysts familiar with both lists. Where the results differ – which they regularly do at the margins of control – the discrepancy should be documented and escalated rather than resolved by taking the more permissive answer.
- Catch-all screening. Even where a product is EAR99 and not on Annex I, the end-use analysis must be applied. For both regimes, an exporter who has reason to believe that goods will reach a prohibited end-use is not protected by a clean classification. The internal screening process should capture and document the end-use and end-user review.
- Periodic re-classification. Classification is not a one-time exercise. Product changes, supply-chain changes, and regulatory changes (including BIS's periodic updates to the Commerce Control List and the EU's revisions to Annex I) require scheduled re-classification reviews. High-risk product lines should be reviewed at least annually.
- Documentation and record retention. Both regimes require exporters to maintain records of classification decisions and supporting analysis. Those records support a voluntary self-disclosure if a compliance error is identified, and they are the primary defence in an enforcement inquiry.
In a recent matter, an industrial-equipment manufacturer had maintained an EAR99 self-classification for a line of thermal-imaging components for several years. When the business expanded its EU operations and engaged EU export-control counsel, a parallel analysis under Annex I revealed that certain components fell within a controlled entry following a 2022 amendment to the EU dual-use list. The manufacturer had been exporting to third-country distributors without EU authorisation. We assisted with the retrospective analysis, the voluntary disclosure to the relevant competent authority, and the redesign of the classification programme. The matter concluded without a penalty determination, but the process took several months and consumed significant management time. Early cross-regime classification would have been materially cheaper.
If a transaction has already been flagged, or a previous classification has been called into question, an early review can preserve options that narrow with time. To discuss a specific classification question or a programme review, contact Calder & Vance at info@caldervance.com.
The UK dimension: a third system in the picture
For businesses with UK operations, a third classification regime sits alongside the EAR and the EU dual-use rules. The UK Export Control Order, administered by the ECJU (Export Control Joint Unit), uses a control list that substantially follows the pre-Brexit EU Annex I as a starting point but has since been amended independently. Since the UK's departure from the EU, the two lists have diverged on some entries, and the UK has introduced its own catch-all controls and cyber-surveillance provisions.
The UK regime does not apply the EAR extraterritorially in the same way, but UK-based exporters of items incorporating US-origin content remain subject to BIS re-export controls in addition to ECJU licensing requirements. A business that operates from both a UK entity and an EU entity for the same product line may be subject to three separate classification obligations for a single transaction – EAR, EU dual-use, and UK Export Control Order – with the possibility that the three produce different answers.
We regularly advise businesses on the interaction between these three systems. The cross-regime analysis is not a luxury for large compliance teams; it is the minimum required for any exporter with multi-jurisdictional operations or US-origin content in its supply chain. For a direct comparison of the EU and SECO positions on equivalent classification questions, the analysis at EAR99 determinations: EU vs SECO compared addresses the Swiss dimension. For the intersection of OFAC sanctions controls and EU export authorisations on the same transaction, see EAR99 determinations: OFAC vs EU analysis.
A common misconception: "EAR99 means no controls apply"
The most persistent myth in export-control compliance is that EAR99 means an item is uncontrolled. That reading is incorrect in three ways.
First, EAR99 means only that the item is not listed at an ECCN. The EAR's end-use and end-user controls still apply. A company exporting EAR99 goods to a party on the Entity List requires a BIS licence. An exporter who knows those goods will be used in a nuclear weapons programme requires a licence. EAR99 is a classification, not an exemption from all controls.
Second, EAR99 says nothing about the EU dual-use regime, the UK Export Control Order, or any other national system. The item may be fully controlled under those regimes, requiring authorisation that an EAR99 determination does not address.
Third, EAR99 status can change. BIS has accelerated the pace of Commerce Control List amendments in recent years, moving items from EAR99 to controlled status with varying transition periods. A static classification programme that does not track regulatory changes will produce stale EAR99 determinations that no longer reflect the current rules.
In our experience, compliance failures in the EAR99 space are rarely about items that everyone knew were controlled. They arise precisely because an EAR99 finding was treated as the end of the inquiry. The better practice is to treat it as one input into a larger compliance picture that encompasses all applicable regimes, all applicable end-use controls, and all applicable restricted-party obligations.
Related practices
- Deemed Export and Technology Controls – BIS / EAR service – licensing and classification advice for technology transfers under the EAR
- EAR99 Determinations: EU vs SECO – comparative analysis of EU dual-use and Swiss export-control classification
- EAR99 Determinations: OFAC vs EU – how OFAC sanctions controls interact with EU export authorisation requirements