A European research consortium shares simulation software with visiting engineers from a third country. No physical shipment leaves the EU. Yet the transfer of controlled technology to a foreign national may require an export licence under the EU dual-use regime – and missing that requirement carries the same legal consequences as a mis-declared physical export. Deemed exports remain one of the most under-appreciated exposure points in cross-border technology work.
Under EU law, a deemed export is the transfer of controlled technology or software to a foreign national within the EU, treated as an export to that person's country of nationality. The governing instrument is the EU dual-use regulation, administered nationally through competent authorities in each Member State. Where technology is listed on the EU Common Military List or the EU Dual-Use List (the control lists setting out items subject to licensing requirements), a transfer by any means – oral briefing, email, cloud access, or hands-on training – may trigger a licence obligation.
This guide works through the EU deemed-export question in five steps: identifying the technology, confirming the nationality trigger, finding the applicable licence route, managing the transfer safely, and monitoring the position across regimes.
Step 1: Identify whether your technology is controlled under EU dual-use rules
The first question is classification: does the technology you intend to transfer appear on the EU Dual-Use List, and if so, under what control entry? The EU dual-use regulation covers goods, software, and technology that have both civilian and military applications. Technology in this context means specific information necessary for the development, production, or use of a listed item – and that information can be conveyed through technical drawings, models, formulae, designs, prototypes, manuals, training, or even conversation.
Classification is not a formality. In our practice, a significant share of deemed-export queries arrive from businesses that have already assumed their technology is uncontrolled, only to discover on closer inspection that it meets the parameters of a control entry. The dual-use list uses precise technical thresholds. A piece of simulation software may be uncontrolled at one performance level and tightly controlled one version later.
The starting point is always the technical specification, reviewed against the parameters in the applicable list entry. Where the technology sits within a broader dual-use-listed system, it is the aggregate capability that matters, not the component in isolation. If you cannot reach a confident classification decision in-house, the competent authority in your Member State provides a binding classification ruling. That ruling is worth obtaining before the transfer, not after.
Step 2: Does the nationality of your recipient trigger the deemed-export rule?
Once technology is confirmed as controlled, the next question is whether the recipient is a foreign national to whose country the technology would require an export licence if shipped physically. The EU regime does not use the term "deemed export" in the same statutory form as the US Export Administration Regulations, but the practical effect is the same: a transfer to a foreign national present in the EU engages the licensing requirements that would apply to a physical export to that person's home country.
This is a point of meaningful divergence between the EU and US positions. Under the EAR (the US Export Administration Regulations administered by BIS), a deemed export is defined with explicit statutory precision, and a deemed re-export rule captures transfers between two non-US nationals outside the United States. The EU's treatment is less codified at the supranational level and is implemented through national transpositions, which means the analysis can differ slightly between Member States.
What is consistent across the EU is this: nationality determines the destination for licensing purposes. A Russian or Chinese national present in Germany is treated, for technology-transfer licensing, as a recipient in Russia or China. Permanent residency in an EU Member State does not change the analysis. Dual nationality may raise additional questions, but the more restrictive position governs as a matter of prudent compliance.
Have you mapped the nationalities of every person who will have access to the controlled technology – not just the primary recipient, but lab partners, technicians, and IT administrators with system rights?
Step 3: Which licence route applies, and how does the process work?
Having established that a licence is required, the next step is identifying the applicable authorisation. The EU dual-use regime offers three main routes: a Union general export authorisation, a national general authorisation, or an individual licence issued by the Member State competent authority. Not every route is available for every destination or every technology category.
Union General Export Authorisations (UGEAs) permit exports of specified technology to specified destinations without a case-by-case application. They carry conditions: the exporter must register with the competent authority in its Member State before first use, maintain records of each use, and report use periodically. The registration step is frequently overlooked. A business relying on a UGEA that it has never registered is not properly authorised, and that gap can surface in an audit.
Where a UGEA does not cover the destination or the technology, an individual licence application is required. The application goes to the competent authority in the Member State where the exporter is established. Supporting documentation typically includes a technical description of the technology, an end-user statement, and where required by the authority, an end-use certificate from the recipient's home country. Processing timelines vary between Member States and depend on the sensitivity of the item and the destination, but applicants should plan for several weeks at minimum. Verify the current position with the relevant competent authority before committing to a delivery schedule.
The position above covers the standard application case. Your facts – the technology, the recipient's nationality, the Member State of establishment, and any parallel obligations under the Common Military List – change the analysis materially.
For a preliminary assessment of your EU deemed-export position, contact Calder & Vance at info@caldervance.com.
Step 4: Cross-regime risk – how do EU obligations interact with US and UK rules?
EU deemed-export exposure rarely arises in isolation. Most technology-intensive businesses have parallel obligations under the US EAR, the UK export-control regime administered by ECJU, or both. Managing the interaction correctly is one of the harder practical problems in cross-border dual-use compliance.
Under the EAR, a deemed export of US-origin technology occurs when a foreign national receives controlled technology in the United States. A deemed re-export occurs when that technology is subsequently transferred to another foreign national outside the US. The extraterritorial reach of US controls means that EU-based businesses handling US-origin software or technology must apply the EAR analysis alongside the EU analysis. The more restrictive obligation governs. Where the US requires a licence and the EU does not – or vice versa – the business must comply with both.
The UK position post-Brexit is separately administered. ECJU issues export licences under the UK Strategic Export Licensing regime. UK controls broadly mirror the pre-Brexit EU list, but they have since diverged in some respects, and licence applications go to ECJU rather than the EU Member State authority. A transfer by an EU-established entity to a UK-based foreign national does not engage UK controls, but a UK entity making the same transfer must assess both the UK and EU positions if any part of the technology chain touches EU jurisdiction.
In our cross-border practice, the most common complexity involves a single technology package that is partly of US origin and partly developed within the EU. Both regimes apply to their respective components. The integration of those components can create a product that is controlled under one or both regimes even where neither component was controlled independently. That is the re-export and retransfer question, and it requires careful upfront classification work.
For a comparison of how BIS and the EU competent authorities handle deemed-export applications for the same technology, see our service page on deemed-export and technology-transfer services under BIS and the EAR.
If a transfer has already been made and you are uncertain whether it was properly licensed, an early compliance review can preserve options that narrow with time. Contact info@caldervance.com for a confidential initial assessment.
Step 5: Record-keeping, internal controls, and programme maintenance
Obtaining a licence does not end the compliance obligation; it begins the record-keeping phase. EU dual-use rules require exporters to maintain records of all controlled transfers for a minimum period from the date of the transaction. Competent authorities conduct post-shipment and post-transfer verifications. The records must be sufficient to allow the authority to reconstruct the basis for the licence, the identity of the recipient, and the end use. Where a UGEA was relied upon, records must show each use and the registration that preceded it.
Internal controls for deemed exports go beyond record-keeping. An effective programme addresses three practical questions. First, how does the business identify controlled technology before it reaches a foreign national – in the onboarding of visiting researchers, in shared-access software licences, or in collaborative R&D programmes? Second, who in the business is authorised to make the deemed-export licensing decision, and is that person trained on the current list? Third, how does the business handle a change in the recipient's circumstances – a change of nationality, a change of employer, or a change of the project scope that brings new technology into scope?
The answer to the third question is what separates a mature programme from one that passes an initial audit and then drifts. Technology-transfer situations are not static events; they are ongoing relationships in which the compliance position must be reviewed whenever the facts change.
We regularly advise research-intensive businesses and exporters on the design of internal controls that address deemed-export risk at the point of access, not retrospectively. A programme designed around the EU list parameters, with clear nationality-screening steps and UGEA registration workflows, reduces the manual assessment burden considerably.
Risk flags: when does deemed-export exposure become acute?
Several fact patterns substantially raise the risk level in deemed-export situations and call for early involvement of export-control counsel.
The first is a high-control destination. Where the foreign national's home country is subject to the full range of EU restrictive measures – meaning both financial sanctions and export prohibitions are in force – the technology-transfer analysis must account for the possibility that no licence will be granted regardless of the technical merits of the application. A UGEA will not cover such destinations. An individual licence application will face a high bar, and in some cases the applicable national provisions will prohibit the transfer outright.
The second is cross-border research collaboration involving US-origin components. As noted above, the EAR deemed-export analysis runs in parallel. A single incorrect classification on the US-origin element can create exposure under two regimes simultaneously.
The third is a merger or acquisition involving a technology-holding target. Post-acquisition, the acquiring business assumes responsibility for the target's compliance record. Any unreported deemed exports in the target's history become the acquirer's problem. Pre-transaction deemed-export due diligence is a standard component of our cross-border diligence work.
The fourth is a change of circumstances that the business did not catch. A foreign national who was properly cleared at the outset of a project may subsequently change employment, nationality status, or end-use context in a way that voids the original analysis. Static screening at onboarding is not sufficient.
Is your current compliance programme designed to catch a change in recipient circumstances mid-project, or only at the point of initial access?
Related practices
- Deemed-export and technology-transfer services under BIS and the EAR – US export-control classification, licence applications, and EAR deemed-export advice for cross-border transactions.
- Deemed exports and technology transfer: OFAC guide – how OFAC sanctions intersect with technology transfer to foreign nationals and sanctioned-country nationals.
- Deemed exports and technology transfer: OFAC guide 2 – deeper analysis of secondary-sanctions risk and screening obligations for technology-transfer scenarios.
Addressing a common misconception: "We only transfer to EU residents, so we are not exporting"
One misconception we encounter regularly is the belief that a transfer to a person physically present in the EU cannot be an export. The reasoning is intuitive but wrong. The EU dual-use regime does not ask where the recipient is standing; it asks to which country the technology would be licensed if it were physically shipped. A person's nationality determines the effective destination. The physical location of the transfer is irrelevant to the licensing trigger.
A related misconception is that cloud-based or software-as-a-service access does not constitute a technology transfer. It does, where the foreign national can access controlled technical parameters through that access. The medium of transfer – cloud, API, direct download, or hands-on training in a lab – does not change the analysis under EU dual-use controls. What matters is whether the foreign national receives controlled technology, not how it reaches them.
We have acted for technology developers and research institutions that discovered, on reviewing their access-control logs, that controlled technology had been accessed by foreign nationals from high-sensitivity destinations without any licence in place. An early voluntary disclosure to the competent authority, supported by a clear account of the circumstances and a remediation plan, is a materially better position than discovery by the authority without prior disclosure. That principle holds across EU Member States and mirrors the treatment of voluntary self-disclosure under the EAR and OFSI's enforcement guidance.