How to meet licence conditions on controlled computing under BIS / EAR

A shipment of advanced computing equipment clears customs documentation, a BIS licence sits in the file – and then the compliance team realises it has not set up the reporting mechanism the licence expressly requires. The transaction is already in motion. What happens next can determine whether the firm faces a voluntary self-disclosure or something more serious. That single gap, between holding a licence and meeting its conditions, is where export-control exposure most often crystallises for technology exporters.

Licence conditions for controlled computing exports under the BIS / EAR regime are legally binding obligations attached to a specific authorisation. They govern how the export may proceed, not merely whether it may. Items classified under an ECCN (Export Control Classification Number, the BIS code on the Commerce Control List that determines what controls apply) are subject to the EAR throughout their lifecycle. A licence grants permission; its conditions define the terms of that permission and, if unmet, can render the originally lawful export a violation.

This guide walks through each step of the licence-conditions process in sequence – from pre-shipment set-up through ongoing reporting, end-use verification, and what to do when a condition cannot be met – and flags where the BIS / EAR position differs from the UK ECJU and EU dual-use regimes.

Step 1: Read the licence before the goods move

The licence document itself is the operative legal instrument, and it must be reviewed in full before any shipment occurs. BIS licences are not generic permissions; each one can carry bespoke conditions drafted for the specific transaction, end-user, and destination.

In our experience, compliance teams sometimes treat a granted licence as a clearance signal rather than a document requiring implementation. That is the wrong approach. The licence may require delivery verification, pre-shipment notification to BIS, restrictions on which company personnel may access the equipment, limitations on geographic movement after delivery, or prohibitions on certain technical applications. All of these must be identified before the goods move, not after.

The practical step is a licence-conditions matrix: a structured document mapping each condition to the person responsible for meeting it, the deadline or trigger event, and the evidence that will demonstrate compliance. That matrix should be reviewed by both the exporting firm's compliance function and any freight or logistics intermediary involved in the shipment. Conditions flow to sub-contractors as a matter of contract as well as of export-control obligation.

How do you know whether a condition has a pre-shipment trigger or a post-delivery trigger? The condition text usually specifies. Where it is ambiguous, the safer reading is the earlier trigger. Do not assume post-delivery unless the language is clear.

Step 2: Classify accurately and confirm the licence covers the item as it will be shipped

A BIS licence is issued against a specific classification and a specific end-user; if either has changed since the application, the licence may not cover the shipment as it now stands. Classification accuracy is not a one-time exercise: it must be confirmed at the point of shipment.

Items subject to the EAR but not listed on the Commerce Control List carry the designation EAR99 (a residual classification meaning the item is not specifically controlled but remains subject to the EAR's general prohibitions). An advanced computing component may be classified under a specific ECCN when it meets certain performance thresholds and EAR99 when it does not. If a component is upgraded after the licence application, the classification question reopens.

The licence application described the item in its configuration at the time of submission. If the configuration has changed – different memory, updated firmware, bundled software that was not in the original application – compliance counsel should confirm whether the licence still covers the item or whether an amendment or new application is required. Shipping a materially different item on an existing licence is a common source of apparent violations.

For computing equipment specifically, the performance parameters that determine classification can shift with a software update. We regularly advise exporters to build a configuration-lock procedure into their release process so that the item leaving the warehouse matches the item described in the licence. This is particularly important where the BIS / EAR licence addresses advanced computing items, which may also be subject to conditions designed to prevent military end-use.

Step 3: Implement the delivery, verification, and reporting conditions

Once the goods have shipped, the licence conditions governing delivery, verification, and reporting become active obligations and they run on their own timelines. Missing these is one of the most frequent compliance failures for licensees, because the urgency of the shipment phase has passed and ongoing obligations can drop from view.

Delivery conditions typically require the licensee to obtain written confirmation from the consignee that the goods have arrived at the destination stated in the licence. Some licences require delivery confirmation within a defined period. The confirmation should be obtained, stored, and linked to the licence record. Records must be kept for five years under the EAR, as currently in force; verify the current position before relying on it.

Reporting conditions vary. Some licences require a post-shipment report to BIS within a specified window. Others require annual reports for the life of the authorisation. The compliance calendar should capture every reporting deadline on the licence, with reminders set ahead of each one. A report submitted late is a violation even where the underlying export was fully compliant.

End-use certificates are a related instrument. Where the licence required an end-use certificate from the consignee, that document should be in the file before shipment; it is a condition precedent, not a post-hoc courtesy. BIS may conduct post-shipment verifications (on-site or remote checks that the item reached the stated end-user and is being used for the authorised purpose), and the absence of an end-use certificate at that stage is a serious evidentiary gap.

Step 4: Manage end-use and re-transfer controls for the life of the authorisation

A BIS licence does not expire when the goods cross the border. The EAR's reach continues to govern the item throughout its life, wherever it travels. Re-export and in-country transfer restrictions are conditions that follow the item, not the original transaction.

For controlled computing equipment, this matters because the item may be incorporated into a larger system, re-exported to a third country, or transferred within the destination country to a different end-user. Each of those events may require a separate licence or the application of a licence exception. A condition on the original licence that prohibits re-transfer without BIS authorisation is binding on the consignee, and the exporter retains responsibility for ensuring that prohibition is communicated and, where possible, contractually embedded.

The Foreign Direct Product rules (FDP rules, which extend EAR jurisdiction to certain foreign-produced items that are the direct product of controlled US technology or software) mean that technology transferred under a licence can generate further controlled items downstream. In our cross-border practice, we find that exporters who have carefully managed the initial licence conditions are sometimes unaware that later downstream products created using licensed technology may themselves carry EAR obligations. This is a structural point about the EAR's extraterritorial reach that distinguishes the US regime from the EU and UK approaches.

End-use monitoring for the life of an authorisation is not a passive exercise. It requires the licensee to have a contractual mechanism to obtain information from the consignee about the item's location, use, and any proposed re-transfer. Where a consignee is unresponsive or reports a use that raises concerns, that is a compliance trigger requiring immediate attention from export-control counsel.

Step 5: Handle a suspected conditions breach before it becomes an enforcement matter

When a possible breach of a licence condition is identified – a late report, an unconfirmed delivery, an unapproved re-transfer – the question is not whether a problem exists but how to manage it within the framework the EAR provides. Speed and documentation discipline are the deciding variables.

Voluntary self-disclosure (VSD, a disclosure to BIS of a potential violation before the agency discovers it independently) is a recognised mitigating factor under BIS enforcement policy. A timely, accurate, and complete VSD can materially reduce the enforcement consequences of a conditions breach. It also demonstrates the kind of good-faith compliance posture that regulators credit in subsequent dealings.

The internal steps are: stop the activity that constitutes the potential breach; preserve all relevant documents; conduct a focused internal review to understand the scope and cause; and involve export-control counsel before any communication with BIS. Do not destroy documents, do not attempt to retroactively create compliance records, and do not contact BIS informally before taking legal advice. Each of those steps can worsen the position.

If the issue is a condition that the licensee cannot practically meet – the consignee has moved, the delivery address has changed, the required end-use certificate has not been returned – the answer is a licence amendment request, not silence. BIS can be approached for an amendment before a violation crystallises. That is a much stronger position than disclosing after the fact.

It is worth asking at this stage: does the compliance programme have a clear escalation path from the desk-level identification of a potential breach to senior compliance leadership and counsel? In our experience, the gap between discovery and escalation is where conditions breaches become serious enforcement matters.

Step 6: Compare the BIS / EAR approach with the UK ECJU and EU dual-use regimes

Any exporter with operations in both the United States and Europe will be managing BIS / EAR licence conditions alongside, and sometimes in tension with, ECJU and EU dual-use requirements. The regimes share concepts but diverge in structure and enforcement posture in ways that create real operational complexity.

The UK ECJU issues Standard Individual Export Licences (SIELs) and Open Individual Export Licences (OIELs) for controlled technology exports. Conditions on UK licences are administered by the ECJU and may differ substantially in their reporting format and frequency from BIS conditions on the same item. A dual-use computing item may require simultaneous compliance with a BIS licence condition on reporting and a SIEL condition on end-use certification, both running on different timelines.

The EU dual-use regime, currently administered under the recast dual-use regulation, similarly imposes end-use undertakings and, for certain sensitive items, pre-export notification obligations. EU member states administer the regime through national authorities, which means that conditions attached by France's export-control authority to a re-export of US-origin computing equipment may differ from those attached by Germany's authority for a parallel shipment. Where the EU Blocking Regulation applies – which prohibits EU operators from complying with specified third-country measures – there is a direct legal tension with BIS conditions on the same goods that requires specific legal advice.

The structural difference is extraterritorial reach. The EAR follows the item globally through the FDP rules. EU and UK licences operate primarily on a territorial basis: they govern what leaves their jurisdiction, not the full downstream lifecycle. That asymmetry means a BIS licence condition will typically impose the longer-running obligation, but the EU or UK condition may be the stricter one for the initial export leg. Where two regimes both apply, the stricter prohibition governs.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, and the intersection of BIS conditions with ECJU and EU obligations is a recurring point of complexity in cross-border computing transactions.

Related practices

• OFAC Licensing for Controlled Computing – sanctions licence strategy for computing exports under US financial-sanctions authority
• OFAC Licence Conditions for Computing Exports – step-by-step guide to meeting OFAC licence conditions on controlled technology

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.