A technology exporter ships consumer-grade electronics to a distributor in the UAE. The items were never classified against the Commerce Control List. The exporter assumes they are EAR99 and ships without a licence. Six months later, a compliance audit surfaces a question: was that assumption correct under both the Export Administration Regulations (the EAR – the US export-control rules administered by the Bureau of Industry and Security, or BIS) and the UAE's own controls? And does the UAE's position as a significant re-export hub change the analysis at all?
An EAR99 determination is the conclusion that an item subject to the EAR falls outside every category on the Commerce Control List and therefore requires no BIS licence for most destinations – including the UAE – absent a specific end-user or end-use concern. As of April 2026, the UAE sits outside the most restrictive US destination groupings, but its role as a transshipment centre and its own national controls mean an EAR99 classification alone does not end the analysis. The procedure, the cross-regime overlay, and the points where exporters routinely miscalculate are set out below.
This guide walks through each stage of the determination process, flags the UAE-specific risks that a US-only analysis misses, and identifies when a matter needs specialist export-control counsel.
Step 1: Understand what EAR99 means – and what it does not mean
EAR99 is not a classification assigned by BIS; it is the residual category that applies when an item is subject to the EAR but does not match any Export Control Classification Number (ECCN – the alphanumeric code that identifies controlled items on the Commerce Control List) in the CCL. The item falls outside the positive list of controlled goods, technology, and software.
That matters for the UAE context. EAR99 status says nothing about whether the transaction is clean. BIS still prohibits exports of EAR99 items to parties on the Entity List (a BIS list of persons subject to licence requirements), the Denied Persons List, or the Unverified List. OFAC's sanctions remain fully applicable. A US person cannot ship EAR99 goods to an SDN-listed UAE entity any more than it can ship controlled goods.
In our cross-border practice we regularly find that exporters treat "EAR99" as a green light. It is not. It removes one layer of control – the CCL licensing requirement – but leaves all the others intact. The determination is the beginning of the export-compliance analysis, not the end of it.
Step 2: Determine whether the item is subject to the EAR at all
Before reaching the EAR99 question, you must confirm that the item is within the EAR's scope. The EAR covers items that are in the United States, of US origin, or that contain US-origin content or technology above the applicable de minimis threshold. It also captures items produced abroad using certain US technology or equipment under the foreign direct product rule (the FDPR – a rule extending EAR jurisdiction to foreign-made products that are the direct product of controlled US technology or software).
The FDPR is an area of particular exposure in UAE supply chains. A product manufactured in a third country may be subject to the EAR even if it contains no US components, if it was produced using US-origin fabrication equipment or software. Exporters shipping through UAE free-trade zones regularly underestimate this. Do you know whether your manufacturing process or your supplier's process triggers FDPR coverage?
If the item is not subject to the EAR at all – because it is an exclusively foreign-origin item with no US nexus – then EAR99 is not the applicable concept. The item may still be controlled under other regimes, including the UAE's own rules, but the US classification question does not arise.
Step 3: Screen against the Commerce Control List – the classification procedure
The core EAR99 determination follows a structured three-part sequence. Work through each stage in order; do not skip to the conclusion.
- Product characterisation. Document the item's technical parameters in full: physical composition, operating specifications, software functionality, technology content, and any integrated sub-components. This is the foundation. Classification errors almost always trace back to an incomplete technical description at this stage.
- CCL comparison. Compare the item's parameters against the relevant CCL categories. The CCL is organised by ten categories (categories 0 through 9, covering nuclear, materials, electronics, computing, telecommunications, sensors, lasers, navigation, marine, and aerospace/propulsion). Each category contains ECCNs with defined control parameters. The exporter must work through the relevant categories, not merely check the most obvious one. An item with telecommunications functionality should be checked against both the electronics and telecommunications categories, for example.
- Residual determination. Only if the item does not match any ECCN's parameters can it properly be classified EAR99. Document the analysis: which ECCNs were considered, which parameters were compared, and why none matched. A bare assertion of "EAR99" with no documented process is not a defensible position in a BIS enforcement review.
In a recent matter, a logistics technology business sought to ship operational software to a UAE-based client. The software had originally been developed for consumer applications and the exporter had logged it as EAR99 for years. On reviewing the actual technical parameters, the updated version incorporated encryption functionality that brought it within a controlled ECCN. The exporter's EAR99 designation was out of date. We assisted with a re-classification, a corrective filing, and an update to the internal classification procedure. The matter was resolved without enforcement action.
Step 4: Apply the UAE-specific end-user and end-use checks
Even a correctly determined EAR99 item requires end-user and end-use screening before export to the UAE. This is the layer that generates the most enforcement exposure in practice.
BIS maintains several restricted-party lists beyond the SDN List. Any match against the Entity List, Denied Persons List, or Unverified List imposes a licence requirement even for EAR99 items, regardless of destination. For the UAE specifically, the Entity List has included UAE-based entities in enforcement actions relating to re-export concerns. A clean CCL search does not replace a current restricted-party screen against all BIS lists.
End-use red flags under the EAR include: procurement patterns inconsistent with the stated use; routing through intermediaries with no plausible commercial need in the transaction; requests to remove country-of-origin markings; payment from unrelated third parties; and requests to ship to a free-trade zone without a named end-user at the final destination. The UAE's geography – multiple free-trade zones, significant re-export volumes, and proximity to destinations subject to heavier controls – means these red flags appear more frequently in UAE-routed transactions than in many other corridors.
The position above covers the standard case. Your facts – the specific goods, the named buyer, the free-trade zone involved, the stated end-use, and the broader transaction structure – change the analysis materially.
For an initial assessment of your export-control exposure under the EAR and the UAE overlay, contact Calder & Vance at info@caldervance.com.
Step 5: Overlay the UAE's own national export-control regime
The UAE operates its own national export-control regime, administered by the Strategic Goods Regulation authority. The UAE controls cover strategic goods, dual-use items, and certain technologies, with a positive control list that is distinct from the US CCL. An item that is EAR99 under US rules may nonetheless be controlled under the UAE's strategic goods list.
This matters for businesses that route goods through UAE free-trade zones. If goods are imported into a UAE free-trade zone and then re-exported, the UAE regime applies to the re-export. Compliance counsel frequently encounters the assumption that free-trade zone status means the goods are outside UAE jurisdiction. That assumption is incorrect. UAE controls apply to strategic goods moving through the zones, and the UAE authorities have the capacity to enforce against transactions that raise proliferation or diversion concerns.
The UAE is also a member of several international export-control co-operation arrangements, and it has strengthened its enforcement posture in recent years in response to international scrutiny of re-export patterns. Exporters who rely solely on a US EAR99 determination without reviewing UAE domestic controls are carrying a compliance gap that enforcement action – by either the US or UAE authorities – can expose.
Beyond the UAE's domestic regime, the EU's dual-use rules are relevant for any European entity in the supply chain. EU Regulation 2021/821 governs the export of dual-use items from EU member states. An item may be outside US CCL controls and outside the UAE strategic goods list but still require an EU licence if it is exported from an EU jurisdiction and meets EU dual-use thresholds. For multi-jurisdictional supply chains, a single determination in one regime is not sufficient.
Step 6: Document, retain, and review
A defensible EAR99 determination is not a one-time event. It is a documented, retained, and periodically reviewed conclusion that tracks the item's technical evolution and the regulatory environment.
Documentation standards for a BIS enforcement review require the exporter to reconstruct the classification decision: what technical parameters were examined, which ECCNs were considered and rejected, who made the determination, and when. Where a determination is made by a non-specialist, BIS will ask whether reasonable care was exercised. A documented process is the primary evidence of reasonable care.
Retention is equally important. The EAR requires exporters to keep export-related records for five years from the date of the transaction. That window covers the period during which BIS may initiate a review. Records that cannot be produced when a review is opened effectively convert a defensible compliance position into an aggravated one.
Review matters because items change. Software updates, new functionality, hardware revisions, and regulatory amendments to the CCL can each alter a classification conclusion. An EAR99 determination made three years ago for a product in its current version may not hold for the next version. In our experience, businesses with fast product-development cycles are the most vulnerable to classification drift. A systematic re-classification review tied to product-update cycles is the control that prevents it.
If a transaction has already been flagged, a filing refused, or a compliance gap identified in an audit, an early structured review can preserve options that narrow quickly once a regulator becomes aware of the issue.
To discuss an EAR classification review or a cross-regime export-control assessment, write to Calder & Vance at info@caldervance.com.
Where EAR99 determinations most often go wrong: common pitfalls
The six failure modes we see most consistently are distinct and addressable.
- Incomplete technical characterisation. Classification based on marketing descriptions or product brochures rather than engineering specifications. Brochures omit the technical parameters that determine classification. Always work from the technical data sheet and, where relevant, the source code or design documentation.
- Single-category searching. Checking the most obvious CCL category and stopping. Items with overlapping technical characteristics – an item with both sensor and telecommunications functions, for instance – must be checked across all relevant categories before EAR99 can be concluded.
- No FDPR analysis. Treating the EAR as inapplicable to foreign-manufactured goods without reviewing FDPR coverage. In UAE-linked supply chains involving third-country manufacturers, FDPR exposure is a regular finding.
- Treating EAR99 as end-user neutral. Failing to screen the specific UAE buyer, intermediary, and end-user against all BIS restricted-party lists after completing the CCL analysis.
- Ignoring UAE domestic controls. Assuming that US export-control clearance is sufficient without checking the UAE's own strategic-goods control list.
- Static determinations. Making a classification once and not updating it when the product or the regulatory position changes. Classification is a living document, not a permanent record.
A single mis-classified item that reaches a restricted end-user can generate a BIS enforcement action, a criminal referral, and reputational exposure simultaneously. The cost of a proper classification process is a fraction of the cost of a post-shipment problem. Have you validated your EAR99 inventory against the current CCL and the current UAE-specific risk environment?
Cross-regime divergence: where the US, UK, EU, and UAE controls interact
The UAE corridor sits at the intersection of four distinct export-control systems. An item EAR99 under US rules may be controlled under UK, EU, or UAE domestic lists. Conversely, an item classified under a US ECCN may fall outside other regimes' controls. The regimes do not align.
Under UK export controls, administered by the Export Control Joint Unit (ECJU), controlled items are identified on the UK Strategic Export Control Lists, which were retained and updated following the UK's departure from the EU. The UK list draws on the same international control list architecture as the EU and the CCL, but the instruments and the licensing authorities are separate. A UK exporter shipping to the UAE must assess the item under UK controls independently of any US EAR determination.
Under EU rules, an exporter based in an EU member state must assess items under EU Regulation 2021/821. The EU dual-use list and the CCL share significant architecture but are not identical. Items at the margin – items close to but not meeting a CCL ECCN threshold – may nonetheless meet an EU dual-use threshold, or vice versa. Businesses that operate across both the US and EU jurisdictions need a parallel classification process, not a single US-driven output extended to the EU.
For the UAE-based recipient, the UAE's own strategic-goods controls apply to any further transfer. A business that intends to re-export goods from the UAE must assess the re-export against UAE controls, the EAR re-export rules, and potentially the controls of the re-export destination country. The layering of these obligations is where compliance programmes most frequently have gaps.
The principle that applies across all of these regimes is straightforward: where two or more regimes cover the same transaction, the stricter prohibition governs. An EAR99 finding does not override a UK or EU licence requirement.
Related practices
- Deemed export and technology controls under the BIS EAR – US deemed-export analysis, technology classification, and licence applications for controlled releases to foreign nationals
- ECCN classification under Australia's export-control regime – classification procedure, the Australian Defence Export Controls list, and cross-regime comparison
- ECCN classification under the BIS EAR – step-by-step CCL classification guidance, licence exceptions, and common classification errors