A technology exporter based in the European Union receives a purchase order from a distributor in South-East Asia. The goods are software-controlled test instruments. Before shipment, someone asks the question that determines whether a licence is needed: what is the Export Control Classification Number (ECCN – a code on the US Commerce Control List that determines whether a BIS licence is required for a given export) for this item? If the answer is wrong, the exporter faces potential civil and criminal liability under the Export Administration Regulations (the EAR – the body of rules administered by the Bureau of Industry and Security governing the export of dual-use and commercial items from the United States and, in certain circumstances, from third countries).
As of April 2026, classifying an item under the BIS / EAR requires a disciplined five-step process: identify the item and all its technical parameters; search the Commerce Control List systematically from the most sensitive categories downward; apply each ECCN's classification criteria rigorously; determine the applicable controls that attach to that ECCN; and document the determination in a record that will survive regulatory scrutiny. Where no ECCN applies, the item is classified as EAR99 – but that classification carries its own conditions and is not a safe harbour against all end-use controls.
This guide walks each step in sequence, identifies where classification goes wrong, and explains where the BIS / EAR regime interacts with UK, EU, and other export-control regimes that may impose parallel obligations on the same transaction.
Step 1 – Gather every technical parameter before you open the Commerce Control List
Before any search of the Commerce Control List, gather a complete and accurate technical specification for the item, because ECCN thresholds are parameter-driven and a single missing figure can produce a classification error that survives for months.
The Commerce Control List is organised into ten categories (from Category 0 covering nuclear materials to Category 9 covering aerospace and propulsion) and five product groups (Equipment, Assemblies and Components; Test, Inspection and Production Equipment; Material; Software; Technology). Classification sits at the intersection of a category and a product group. Reaching the right answer requires knowing the item's physical parameters – frequency bands, accuracy ratings, processing speeds, material compositions, tensile strengths, and any other specification expressly referenced in the relevant ECCN entry.
In our experience, the single most common source of mis-classification at this stage is an incomplete datasheet. Engineers often supply a commercial specification sheet written for procurement, not for regulatory analysis. That document may omit parameters that are decisive for the classification exercise – for example, a frequency upper bound that determines whether communications equipment falls into a controlled category or drops below the threshold into EAR99. Ask for the full engineering specification, and ask whether the item performs functions that are not described in the commercial datasheet.
One further question matters at this stage: is the item controlled for reasons other than its inherent specifications? Certain items become subject to heightened control because of who is buying them, what they will be used for, or where they are going. Those are end-use and end-user controls, which attach at a later stage of the analysis – but awareness of the intended transaction helps focus the classification exercise from the outset.
Step 2 – Search the Commerce Control List in order, starting with the most sensitive categories
The Commerce Control List search must be systematic, not intuitive: begin at Category 0 and work forward, because entries in earlier categories can capture items that a less careful analyst would classify under a later, less-controlled category.
This ordering discipline matters because many dual-use items have characteristics that appear in more than one category. A piece of software that controls a piece of precision machinery might arguably sit in Category 2 (materials processing), Category 3 (electronics), or Category 4 (computers), depending on which function the analyst focuses on. The correct approach is to read the entries in sequence, identify every entry for which the item could plausibly qualify, and then work through each one rigorously.
Within each category, the product-group structure guides the next layer of the search. Equipment and assemblies are Group A; technology is Group E. The same physical item and the embedded know-how used to operate it may carry different ECCNs – and both classifications matter, because exporting the item and separately transferring the associated technology may each require a separate licence determination. We regularly advise clients who have correctly classified the hardware but overlooked the deemed export (a release of controlled technology to a foreign national within the United States, treated as an export to the foreign national's country of most recent citizenship) implications of the technology component.
Use the text of the List, not internal shorthand or prior classifications that have not been reviewed. The Commerce Control List is amended regularly. An ECCN that was accurate for a prior version of a product may not be accurate for a revised version, and a control entry that existed in a prior year may have been restructured.
Step 3 – Apply the ECCN criteria precisely and document each threshold test
Having identified the candidate entries, apply the technical criteria of each one with precision, comparing the item's actual parameters against the numerical or descriptive thresholds in the entry, and recording the comparison in a written determination.
Each ECCN entry contains an items paragraph that defines what is controlled, a parameters section that sets the thresholds, and a set of related controls and notes. The discipline here is to read the entry text, not to paraphrase it. Regulatory text in export controls is drafted with a precision that paraphrase destroys. A threshold stated as "greater than" a given value means something different from "greater than or equal to", and those words are chosen deliberately.
Where the item clearly exceeds an ECCN threshold, the classification is straightforward. Where it falls below every threshold in a candidate entry, it is not controlled under that entry. The difficulty arises in the middle ground, where a parameter is close to the threshold and the specification data is itself subject to tolerance ranges. In that situation, the classification should be built on the worst-case specification – the value that places the item closest to or above the threshold – because regulators will apply the same approach in an enforcement context.
Notes and special definitions within each entry must also be checked. Many entries include notes that carve items out of control or that expand it. A civil aircraft exemption note, a mass-market software note, or a specially designed definition can entirely change the outcome of the analysis. Overlooking a note is a common source of error; we have seen classification opinions that were internally consistent but factually wrong because a definitional note was not read.
Document every threshold test in writing, referencing the parameter measured, the source of the measurement, the ECCN threshold, and the conclusion. That record is the foundation of the determination and of any future audit or enforcement defence.
How does the EAR99 outcome work, and when is it not the end of the analysis?
EAR99 is the residual classification for items subject to the EAR that do not fall under any ECCN on the Commerce Control List; it does not mean the item is freely exportable to all destinations and all end-users.
An EAR99 item is subject to several controls that apply regardless of ECCN. The Entity List (a BIS list of foreign parties subject to specific licence requirements because of their involvement in activities contrary to US national security or foreign policy interests) imposes licensing requirements on exports and reexports to listed entities regardless of the item's ECCN. End-use controls under BIS rules prohibit the export of EAR99 items for certain prohibited end-uses, including the production of weapons of mass destruction, even where no ECCN licence would otherwise be needed. Destination controls similarly apply: certain jurisdictions attract BIS conditions on all EAR-subject items, not only those with a specific ECCN.
This is a point that non-specialist compliance teams frequently misread. EAR99 is not a clearance; it is a classification. The transaction still requires screening against the Entity List, the Denied Persons List, the Unverified List, and the relevant end-use checks. An EAR99 shipment to an Entity List party requires a BIS licence. A shipment of EAR99 items to a company that will use them in a prohibited military programme triggers a separate prohibition.
In cross-border transactions, the EAR99 classification also has no necessary bearing on the classification under other regimes. An item that is EAR99 may be controlled under the UK Export Control Order, under the EU dual-use regulation, or under the national export-control legislation of a transit country. We regularly advise businesses that assume an EAR99 determination resolves all export-control questions for a transaction. It resolves the US classification question; the analysis for other applicable regimes must be conducted separately and in parallel.
Step 4 – Determine the licence requirements that attach to the ECCN
Once an ECCN is confirmed, the next step is to determine whether a licence is required for the specific transaction: the ECCN drives to a set of Reasons for Control, and those Reasons for Control, combined with the destination country group, determine whether a licence is needed or whether a licence exception applies.
Reasons for Control include national security, anti-terrorism, nuclear non-proliferation, missile technology, regional stability, crime control, and others. The Reasons for Control associated with a given ECCN are listed in the entry. The relevance of each Reason for Control depends on where the item is going: the EAR places destinations into country groups, and the licence requirement attaches when the Reason for Control is applicable to the destination's group.
The Country Chart (a matrix within the EAR that, for each Reason for Control, shows which destination countries require a licence) is the instrument that converts the ECCN plus destination combination into a licence requirement. Running this analysis correctly requires identifying every Reason for Control in the ECCN, checking each one against the Country Chart for the destination, and then determining whether any applicable licence exception removes the requirement.
Licence exceptions are conditions-based: they apply only when specific requirements are met, and they may impose documentation and record-keeping obligations of their own. An exception that permits export under certain conditions is not satisfied by the export alone; the conditions must be met and documented. The record-keeping obligation under the EAR extends to five years from the date of the export, reexport, or transfer, and applies to the classification determination, the licence or exception relied upon, and the transaction documents.
Step 5 – Record the determination and build a process to maintain it
A completed ECCN classification must be recorded in a written determination that identifies the item version, the classification outcome, the reasoning, the person responsible, and the date – and that determination must be revisited whenever the item or the applicable rules change.
The determination record serves three functions. First, it provides the operational basis for the compliance function to apply the correct controls to shipments. Second, it provides evidence in an enforcement context that the classification was conducted in good faith and with due diligence – a factor that influences how BIS approaches penalty calculations. Third, it enables efficient updating: when BIS amends the Commerce Control List or when the product specification changes, a well-structured determination makes the re-analysis faster and less prone to error.
Maintaining classification determinations is not a one-time exercise. The Commerce Control List is updated through a series of regulatory amendments, including amendments required to implement new multilateral export control arrangements and amendments made unilaterally by the United States. A classification that was correct for one product generation may not be correct for the next. Have you built a process to flag product revisions and route them back to the classification team before shipment?
In our experience, the firms that manage this well treat the classification determination as a living document attached to the product record in their ERP system, with a review trigger linked to the product change-control process. The firms that manage it poorly treat the determination as a one-off exercise filed in a folder that no one opens until there is a problem.
Cross-regime comparison: where BIS / EAR classification diverges from UK and EU controls
A BIS / EAR ECCN classification determines the US position only; the same item will require a parallel classification under the UK Export Control Order and the EU dual-use rules, and those regimes use different control lists with different thresholds.
The UK regime, administered by the Export Control Joint Unit (ECJU), uses a control list derived from international arrangements including the Wassenaar Arrangement, the Australia Group, the Missile Technology Control Regime, and the Nuclear Suppliers Group. The structure is broadly comparable to the Commerce Control List – categories and product groups, parameter-based thresholds – but the specific thresholds are not identical, and post-Brexit the UK list has diverged from the EU position in certain areas.
The EU dual-use rules use a control list annexed to the relevant Council regulation. The EU has updated its rules to include controls on cyber-surveillance items that did not previously appear in the list, and that expansion creates a category of items that may be EAR99 or lightly controlled under the EAR but are controlled under the EU regime.
The key operational implication is that a classification programme cannot stop at the ECCN determination. For any transaction with a cross-border element – a reexport from a European subsidiary, a technology transfer involving EU-origin knowledge, a shipment through a UK intermediary – the relevant parallel classifications must be conducted. The stricter prohibition governs: where the EU or UK classification imposes a licence requirement that the EAR does not, the licence is required for the EU or UK leg of the transaction regardless of the EAR outcome.
Singapore, Japan, and certain other jurisdictions also maintain national export-control lists with their own classification requirements. For items that move through multiple jurisdictions before reaching the end-user, or for technology that is released to nationals of multiple countries, a multi-regime classification analysis is the minimum standard of care. A cross-border ECCN classification guide sets out how that parallel analysis is structured in practice. For a related perspective on cross-border classification in a specific product context, see also our further cross-border classification analysis.
Common risk flags and when to involve counsel
Certain fact patterns increase the risk that an ECCN classification will be wrong or that a correctly classified item will still generate a compliance failure downstream – and those patterns are the ones that warrant early legal review.
The highest-risk pattern is a product that straddles multiple categories on the Commerce Control List. When an item has attributes that appear in Category 3 (electronics) and Category 4 (computers) simultaneously, the classification outcome depends on which set of parameters is treated as controlling. That is not always a question with an obvious answer, and the wrong choice can result in either an unlicensed export of a controlled item or an unnecessary licence application that delays shipment. In either case, the cost of getting it wrong exceeds the cost of early advice.
The second high-risk pattern is a product update that changes a specification across a control threshold. A processor speed increase, a frequency range extension, or a change in materials composition can move an item from EAR99 to a controlled ECCN without any obvious change to the product's commercial function. Version-by-version classification review is essential but frequently absent from change-management processes.
The third pattern is a transaction involving an entity on BIS watchlists. Even where the ECCN determination is correct and no BIS licence would otherwise be needed, a shipment to a party on the Entity List, Denied Persons List, or Unverified List requires specific handling. The classification analysis and the party screening are separate steps; they must both be complete before shipment.
A voluntary self-disclosure (VSD – a proactive report to BIS of a potential export-control violation, which can mitigate penalties) is available where a classification error is discovered after export. BIS's enforcement framework treats timely and complete VSD as a significant mitigating factor, though it does not guarantee any particular outcome. If a mis-classification has resulted in an unlicensed export, the question of whether and how to make a VSD should be addressed with counsel promptly, because the window in which a disclosure qualifies as voluntary is defined by when BIS first becomes aware of the violation through its own investigation. For services related to technology release under the EAR, including deemed export compliance, see our deemed export advisory service.
A common myth in this area is that ECCN classification is a once-and-done task that can be handled by the engineering team without legal review. That is not so. Classification requires legal analysis of regulatory text, not merely technical comparison of specifications. Engineering teams are essential contributors to the factual record; the legal analysis of that record against the Commerce Control List is a different skill. Where the two are conflated, the classification opinions that result are often technically detailed and legally thin – precisely the pattern that enforcement attention tends to expose.
In a recent matter, a manufacturer of optical instruments had classified a line of products using a prior version of the Commerce Control List. A control parameter had been amended in the intervening period. The items – previously EAR99 – were now subject to an ECCN with a national security Reason for Control applicable to the destination country. Exports had continued without a licence. We assessed the scope of the apparent violation, advised on the preparation and submission of a VSD, and worked with the client to rebuild the classification process with version-linked review triggers. The matter was resolved without referral to criminal enforcement, though no outcome of that kind can be guaranteed.
Related practices
- Deemed export and technology transfer compliance – BIS / EAR advice on technology releases to foreign nationals within the United States
- Cross-border ECCN classification – parallel classification analysis under BIS / EAR, UK, and EU export-control regimes