A technology business headquartered in the United States ships controlled software to a subsidiary in Germany. The compliance team assumes a standard BIS licence exception covers the transfer. The EU entity then re-exports components to a partner in Singapore. Has anyone checked whether the EU dual-use regime recognises that exception? The answer determines whether the entire supply chain operates lawfully – or exposes the group to enforcement on two continents.
Licence-exception eligibility under the BIS / EAR and under EU dual-use rules differs in structure, scope, and the conditions that must be satisfied before an exporter may rely on them. As of April 2026, the BIS / EAR maintains a catalogue of named exceptions tied to item classification, destination, end-user, and end-use; the EU regime operates through a combination of Union General Export Authorisations and national general authorisations, each carrying its own eligibility criteria. An exception valid under one regime does not automatically confer eligibility under the other.
This analysis maps the key divergences criterion by criterion, identifies where the two regimes converge, and sets out the practical steps a cross-border business should take before relying on any exception.
How the two regimes structure their exceptions
The BIS / EAR and the EU dual-use rules use fundamentally different architectures to define when a licence is not required, and that structural gap is the first divergence a compliance practitioner must understand.
Under the Export Administration Regulations (the EAR) administered by the Bureau of Industry and Security (BIS), licence exceptions are listed by acronym – LVS, TMP, RPL, ENC, and others – each with its own eligibility conditions. An exporter consults the Export Control Classification Number (ECCN, the alphanumeric code on the Commerce Control List that determines what controls apply to an item) for the item in question, checks whether the relevant exception is listed for that ECCN, and then satisfies the conditions that apply: destination tier, end-user eligibility, value caps, and use restrictions. The system is item-centric and exception-specific. Each exception has its own operative rule.
The EU dual-use regime, set out in the relevant Council Regulation on controls for dual-use items, operates differently. The centrepiece of the no-licence-required route is the set of Union General Export Authorisations (UGEAs), which permit exports of specified items to specified destinations without a case-by-case licence, provided the exporter is not aware of a prohibited end-use and satisfies registration, record-keeping, and notification requirements that vary by authorisation. Member States may also issue national general authorisations with their own scope. There is no direct EU equivalent of the BIS named-exception system; the UGEA and national routes are the structural counterpart, but the logic differs.
Why does this matter in practice? Because a US exporter relying on a BIS exception for a re-export from an EU entity cannot assume that the EU entity's outbound transaction is covered. The EU entity must independently satisfy the UGEA conditions or hold a case-by-case licence. In our experience, this is precisely the gap that mid-sized groups miss when they build their supply chains on a single jurisdiction's eligibility assessment.
Destination tiers and country scope: where the regimes diverge most visibly
Both regimes use destination as a primary eligibility criterion, but they draw their country groupings on different lines – and those lines do not coincide.
The BIS / EAR organises destinations into Country Groups (A through E) with sub-tiers, and specific exceptions are available only to specific groups. The most favourable treatment under most exceptions is reserved for a defined set of close partner countries. Many exceptions are unavailable to destinations in the highest-control tiers regardless of the item's sensitivity. Critically, the country-group assignment under the EAR does not map directly onto the EU's destination categories.
The EU dual-use framework lists destinations eligible for each UGEA in the annexes to the relevant regulation. Those lists reflect EU foreign policy and export-control objectives and are not identical to the BIS country groups. A destination that qualifies under one BIS exception may fall outside the scope of the relevant UGEA. Conversely, some destinations accepted under a UGEA may attract heightened scrutiny under the EAR.
This asymmetry creates a real problem for exporters with multi-leg supply chains. Goods routed through an EU intermediary to a third country may be EAR-eligible at leg one but UGEA-ineligible at leg two. Have you mapped both legs against both regimes, or only the first against the regime of origin?
The re-export control dimension adds further complexity. EAR-controlled items carry US jurisdiction wherever they go. An EU entity re-exporting US-origin EAR items must satisfy both the EAR re-export rules and the EU rules for outbound export. Neither regime's exception displaces the other's requirement.
Item classification and the dual-use list comparison
Exception eligibility under both regimes is anchored to item classification, but the classification systems – the US Commerce Control List and the EU dual-use list – are not identical, even though both derive from the multilateral Wassenaar, NSG, MTCR, and AG control lists.
Under the BIS / EAR, the ECCN determines which exceptions are available. An item classified as EAR99 (meaning it does not appear on the Commerce Control List) faces far fewer restrictions, and several exceptions apply to EAR99 items that are not available for listed ECCNs. Items with a higher-tier ECCN – particularly those with multiple reasons for control such as national security, missile technology, or nuclear non-proliferation – face narrower exception eligibility and, in some cases, no exception at all for certain destinations.
The EU dual-use list is organised by category and sub-category in a structure that mirrors the multilateral regimes. An item on the EU list will in many cases correspond to an item with an ECCN, but the correspondence is not exact. Classification under one list does not automatically determine classification under the other. A product may be listed under the EU regime but not on the Commerce Control List, or vice versa. Some items that carry a low ECCN with broad exception availability are subject to tighter controls under the relevant EU category.
For a cross-border group, this means that the classification exercise must be conducted separately under each regime. Relying on the US classification to determine EU eligibility – or the reverse – is an error that compliance counsel regularly encounters. We have acted for technology exporters who discovered mid-transaction that a component with straightforward EAR exception eligibility required a national licence under the EU framework because the EU classification was more restrictive.
The de minimis rule under the EAR is also relevant here. The EAR asserts jurisdiction over foreign-made items that incorporate more than a defined percentage of US-controlled content. The EU dual-use rules do not contain an equivalent de minimis test; EU controls apply to the item as presented for export from EU territory, on the basis of the EU classification. A foreign-manufactured product containing US-controlled technology may be simultaneously subject to BIS re-export controls and to EU export controls on its own classification – each assessed independently.
End-user and end-use conditions: how the eligibility tests differ
Both regimes condition exception eligibility on the exporter's knowledge of the end-user and end-use, but they approach that condition differently – and the difference has enforcement consequences.
Under the BIS / EAR, specific exceptions carry explicit end-user eligibility requirements. Some exceptions are unavailable if the exporter knows or has reason to know that the item is destined for a prohibited end-use or a prohibited end-user. BIS maintains the Entity List (a list of parties subject to additional licence requirements) and the Denied Persons List (parties whose export privileges have been revoked). An item otherwise eligible for a BIS licence exception cannot be exported under that exception to a listed entity. The end-user screen is therefore a hard gate, not a soft consideration.
The EU regime imposes a catch-all control: even where an item is not on the dual-use list, an exporter who knows or is informed by their competent authority that the item is or may be intended for a prohibited end-use must seek authorisation before proceeding. This catch-all applies across the entire EU dual-use control perimeter and operates independently of whether the item qualifies for a UGEA. In practice, it means that an EU exporter cannot rely solely on item classification and UGEA eligibility – the end-use assessment is a freestanding obligation.
The practical divergence is this: under the BIS / EAR, the end-user screen is integrated into the exception eligibility conditions for specific exceptions. Under the EU rules, the catch-all creates a separate, item-independent obligation. A transaction that passes all BIS exception conditions may still require EU authorisation if the exporter is on notice of a sensitive end-use.
Record-keeping obligations follow a parallel but not identical pattern. Both regimes require exporters to retain documentation supporting their eligibility claims. Under the BIS / EAR, a five-year record-keeping requirement applies to export control documentation. The EU rules also impose record-keeping requirements, though the specific retention periods are set by national implementation measures and differ across Member States. An EU entity exporting US-origin EAR items must therefore maintain records satisfying both requirements.
The position above covers the standard case. Your facts – the item, the counterparty, the end-use, the route, and the regimes in play – change the analysis. For a structured assessment of your exception eligibility across both regimes, contact Calder & Vance at info@caldervance.com.
The encryption exception: a case study in structural divergence
Encryption controls illustrate the divergence between the two regimes more sharply than almost any other category, and they are worth examining in detail because encryption features in nearly every technology company's product set.
Under the BIS / EAR, encryption items are classified under a specific ECCN category and are subject to a dedicated exception – commonly referred to in industry as the ENC exception – which permits exports of qualifying encryption products to most destinations after the exporter satisfies notification or review procedures. The ENC exception has tiered conditions: some products qualify for the most permissive treatment immediately; others require a one-time review; and higher-capability items face more restrictive conditions. The system is structured and condition-based, but it has been designed to facilitate commercial encryption exports while maintaining oversight.
The EU dual-use list classifies encryption items in a specific category. EU controls on encryption have historically been somewhat more permissive for commercial items, and several UGEAs cover qualifying encryption software and technology to eligible destinations. However, the scope of the relevant UGEA does not perfectly mirror the BIS ENC exception. Some items eligible for the ENC exception fall outside the relevant UGEA's scope, or the destination is not on the UGEA's permitted list.
For a technology company with a US parent and EU subsidiaries, this means that the US parent's classification and exception analysis does not resolve the EU entity's authorisation position. The EU entity's exports – including intangible transfers of technology – must be assessed under EU rules. If the relevant UGEA does not cover the item or the destination, the EU entity must apply for a national licence from its Member State's competent authority, even if the same item is eligible under the ENC exception in the US.
Does your compliance programme address both classification systems for encryption products, or does it rely on the US classification as a proxy for the EU position?
Registration, notification, and procedural conditions
Beyond substantive eligibility, the two regimes impose different procedural requirements before an exporter may rely on an exception or general authorisation – and these procedural differences create operational compliance obligations that are easy to overlook.
Under the BIS / EAR, reliance on some exceptions requires prior notification to BIS or annual reporting. The ENC exception, for example, has historically required certain notifications for qualifying products. Other exceptions impose conditions that must be met before export – not registered with BIS as a precondition, but documented in the shipper's records and capable of being verified on audit. The BIS / EAR system is largely self-executing: exporters assess their own eligibility, document it, and export. The regulatory check comes at enforcement.
The EU system places greater weight on upfront procedural requirements, particularly for UGEAs. Several UGEAs require the exporter to register with the relevant national competent authority before first use. Some require notification after export within a defined window. Member States implement these requirements differently, which means that an EU exporter operating across multiple Member States may face different registration and notification obligations depending on the country of export. This adds an administrative layer that the BIS / EAR system does not replicate.
The internal compliance programme (ICP) – a documented set of controls, training procedures, and review mechanisms – is a factor in both regimes. BIS encourages exporters to maintain ICPs and treats their existence as a mitigating factor in enforcement. The EU dual-use rules include ICP requirements as a condition for access to certain authorisations in some Member States, and EU guidance strongly encourages their adoption. However, the EU's emphasis on the ICP as an eligibility precondition is more pronounced than BIS's current posture. In our cross-border practice, we consistently advise clients that maintaining a documented ICP that satisfies both regimes' expectations is the single most effective way to preserve exception eligibility across jurisdictions.
Extraterritorial reach and the interaction with secondary sanctions
The BIS / EAR's extraterritorial reach is the single most important cross-border compliance consideration for any business that handles US-origin items or US-controlled technology – and it has direct implications for EU exporters' exception eligibility.
The EAR asserts jurisdiction over US-origin items and US-controlled technology anywhere in the world. A foreign entity re-exporting or retransferring such items must comply with EAR re-export rules. This jurisdiction does not depend on the item being in the United States at the time of the transaction. An EU company that receives US-controlled technology from a US licensor is subject to the EAR for any subsequent re-export, regardless of its EU location.
The deemed export rule extends this further. Under the EAR, the release of controlled technology to a foreign national within the United States is deemed an export to that national's country of nationality. There is a parallel deemed re-export rule for foreign nationals outside the US who receive US-controlled technology from a non-US entity. This rule has no direct equivalent in the EU dual-use regime, which controls tangible and intangible exports from EU territory but does not apply a deemed-export test based on the nationality of the recipient.
The consequence is asymmetric jurisdiction. An EU entity and its US parent may both be conducting exports of the same technology to the same recipient under their respective regimes. The EU entity's transaction is subject to EU dual-use rules based on the classification and destination. The US parent's transaction is subject to the EAR. And if the EU entity subsequently re-exports US-origin technology, it faces EAR jurisdiction again, in addition to EU rules. Exception eligibility must therefore be assessed at each jurisdictional layer independently.
Separately, OFAC sanctions and BIS controls interact in a way the EU regime does not replicate domestically. A BIS licence exception may be available for an item and destination, but if the transaction involves a party on the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons), the export is prohibited under OFAC rules regardless of BIS eligibility. The two US regimes operate in parallel; satisfying one does not satisfy the other. EU sanctions imposed by Council regulation operate similarly alongside EU dual-use export controls, but the institutional structures and the specific prohibited-party lists differ from both OFAC and BIS.
For further analysis of the deemed-export dimension under the BIS / EAR, see our service page on deemed export and technology controls under BIS / EAR.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Common risk flags and when to involve export-control counsel
Several patterns consistently generate licence-exception eligibility risk for cross-border businesses operating across the BIS / EAR and EU dual-use regimes. Recognising them early is cheaper than resolving them after a shipment.
The first is reliance on a single-jurisdiction classification. An exporter who determines exception eligibility only under the EAR – or only under EU rules – and applies that determination to the full supply chain is exposed at every leg that falls under the other regime. Classification and eligibility assessment must be conducted regime by regime.
The second is the assumption that general authorisations are self-executing without registration. Several UGEAs require advance registration with the relevant national competent authority. Exporting before registration is complete may mean that the authorisation is not validly relied upon, even if the item and destination are within scope. BIS exceptions do not generally require prior registration, and exporters accustomed to the BIS system sometimes fail to build the UGEA registration step into their EU export procedures.
The third is inadequate end-use screening. Both regimes impose end-use conditions. The EU catch-all obligation means that knowledge of a sensitive end-use triggers an authorisation requirement even for uncontrolled items. Companies that screen only against listed parties – and do not conduct substantive end-use review – are exposed to this catch-all risk.
The fourth is failure to account for US-origin content in foreign-produced items. The EAR's de minimis rule and its foreign-direct-product rule extend BIS jurisdiction to items that may not be visible as US-controlled from the EU entity's perspective. In our experience, the most common source of undisclosed EAR exposure in EU groups is US-controlled technology embedded in equipment assembled outside the United States.
The fifth is inconsistent internal guidance. A multi-jurisdictional group may have separate compliance teams for the US and EU entities, each working from their own jurisdiction's rules, without a cross-border reconciliation step. The moment those two streams interact – at a re-export, a deemed re-export, or a technology transfer between affiliates – the gap becomes a risk.
Counsel should be involved when: a new item is being classified for the first time under both regimes; a supply chain involves US-origin items re-exported through EU entities; the end-user or end-use is in any way sensitive; a UGEA registration has not been completed before reliance; or when an internal audit flags an inconsistency between EAR and EU eligibility assessments. Earlier involvement reduces the risk of a voluntary self-disclosure or a penalty proceeding.
In a recent matter, a mid-sized industrial equipment manufacturer had been exporting dual-use components to a distributor in a third country under a BIS licence exception. Its EU affiliate was conducting parallel shipments under a UGEA. When the group harmonised its compliance records, it identified that the EU affiliate's UGEA registration had lapsed and that one shipment had been made outside the registration period. We assessed the exposure, advised on remediation and whether a voluntary disclosure to the relevant competent authority was appropriate, and supported the reregistration. The matter was resolved without formal enforcement proceedings.
For analysis of the EU versus SECO (Swiss) exception regime, see our analysis of licence-exception eligibility: EU vs SECO. For a comparison of OFAC and BIS / EAR exception regimes, see our analysis of licence-exception eligibility: OFAC vs BIS / EAR.
A common misconception: one classification resolves both regimes
The most persistent myth in cross-border export-control compliance is that a thorough classification and exception analysis under one regime displaces the need to conduct the analysis under the other. It does not.
The BIS / EAR and the EU dual-use rules derive from the same multilateral control lists. That shared origin creates genuine overlap in the items they control and, to a degree, the destinations they treat with caution. But the exceptions and general authorisations are not mutual recognition instruments. The US has not agreed with the EU that a BIS licence exception satisfies EU requirements, and the EU has not agreed that UGEA eligibility satisfies EAR requirements. They are parallel systems, each with its own jurisdictional reach, its own conditions, and its own enforcement authority.
A compliance professional who tells the board that "we checked the EAR and we're covered" has completed only half the analysis for any transaction involving EU entities or EU-territory exports. The EU analysis must follow, and it must be based on the EU classification, the EU destination list, the UGEA conditions, and the national competent authority's requirements – not on an analogy from the US position.
We regularly advise boards and compliance committees on exactly this point. The regulators on both sides have pursued enforcement actions in cases where the exporter demonstrated good-faith compliance with one regime but had not conducted an equivalent analysis under the other. Good faith under one set of rules does not constitute a defence under the other.
Related practices
- Deemed export and technology controls under BIS / EAR – assessing and managing deemed-export exposure for technology transfers and foreign nationals
- Licence-exception eligibility: EU vs SECO – comparing EU dual-use general authorisations with Swiss SECO exception conditions