A technology business finalises a licensing deal with a distributor in a market its export team has serviced for years. The transaction looks routine. Then an internal audit surfaces a question that nobody had formally answered: what is the Export Control Classification Number (ECCN – the alphanumeric code under the US Commerce Control List that determines whether an item requires a licence before it can be exported or re-exported) for the product being shipped? As of April 2026, the Bureau of Industry and Security (BIS) enforces the Export Administration Regulations (EAR) with an enforcement posture that treats misclassification – even unintentional misclassification – as a potential violation.
ECCN classification under BIS / EAR is a structured, item-specific process governed by the Export Administration Regulations and administered by BIS. Getting it wrong can expose a company to licence violations, civil penalties, and denial of export privileges. This guide walks through the procedure step by step, flags the most common errors, and explains where cross-border complexity – EU dual-use rules, UK export controls, and secondary-sanctions exposure – adds further risk to a classification exercise that many firms treat as purely domestic.
The guide covers: the legal basis for classification; how to work through the Commerce Control List; where classification decisions touch other regimes; the risk flags that practitioners see most often; when a BIS commodity classification request is the right step; and how to document the exercise so it withstands regulatory scrutiny.
What is the legal basis for ECCN classification, and who decides it?
ECCN classification is required by the Export Administration Regulations – the primary US export-control instrument administered by BIS, which sits within the Department of Commerce. The EAR applies to items that appear on the Commerce Control List (CCL) and to a broader category of items that are subject to the EAR even when not explicitly listed. An item's ECCN determines which reasons for control apply to it, which destination countries trigger a licence requirement, and which licence exceptions, if any, are available.
The classification decision belongs, in the first instance, to the exporter. BIS does not pre-approve every export. The exporter is expected to classify its own goods, technology, and software, apply the applicable licence requirements, and keep records of that analysis. This places the compliance burden squarely on the business – and it means that a wrong classification number is the exporter's problem, not something BIS will catch before the shipment leaves.
A parallel point that practitioners raise consistently: BIS exercises jurisdiction extraterritorially. The EAR follows US-origin items and US-origin technology into foreign supply chains, including through the de minimis and foreign-direct-product rules. A European re-exporter, an Asian manufacturer incorporating US components, and a UK distributor of US-origin software can all face EAR obligations. Classification is therefore not a domestic US exercise; it has global supply-chain implications. We regularly advise non-US businesses that have only recently discovered their EAR exposure.
Step 1 – Determine whether the item is subject to the EAR at all
The first step is to confirm whether the EAR applies. Not every item is subject to it: items on the US Munitions List (administered by the State Department under the ITAR), items exclusively controlled by other agencies, and items that are truly outside US jurisdiction may fall outside the EAR's scope entirely. Confusing EAR and ITAR jurisdiction is among the most consequential errors a company can make – the two regimes have different authorities, different licensing routes, and different enforcement consequences.
Items subject to the EAR fall into two categories. First, items that appear on the Commerce Control List and carry an ECCN. Second, items that are subject to the EAR but not on the CCL – these are classified as EAR99, the default classification for low-technology commercial goods that do not require a licence for most destinations. EAR99 is not an exemption; it is a classification. And it is not a permanent status: changes in the list, changes in the end use, or changes in the destination can alter whether EAR99 continues to apply.
One question worth asking before any classification exercise begins: has the item or the technology behind it changed since it was last classified? Product updates, new software capabilities, and changes to the underlying materials can all move an item up the CCL or across the ITAR line. Treating a prior classification as perpetually valid is a risk that audits surface regularly.
Step 2 – Work through the Commerce Control List
The Commerce Control List is organised into ten categories (0 through 9), each subdivided by product type, and each entry carrying an ECCN that encodes the category, the product group, and the reason for control. A classification exercise means reading the CCL systematically, not searching for the closest-sounding entry.
The working method practitioners recommend has four elements.
- Gather the technical parameters. Collect specifications: operating frequencies, data-transfer rates, materials, software function, and any military or dual-use design features. Vague descriptions produce wrong classifications.
- Read the category definitions. Each CCL category has scope notes and definitions. These are binding. An item that feels like a category 4 product (computers) may fall under category 5 (telecommunications and information security) on a careful reading of the definitions.
- Check the control parameters in each relevant entry. CCL entries set numeric thresholds, functional criteria, and capability limits. The question is whether your item meets or exceeds the defined parameters – not whether it resembles the general description.
- Identify the reasons for control. Each ECCN carries one or more reasons for control (National Security, Anti-Terrorism, Missile Technology, Nuclear Nonproliferation, and others). The reasons for control, combined with the destination and end user, determine the licence requirement. An item controlled for Anti-Terrorism reasons has a different licence-trigger map than one controlled for National Security reasons.
In our experience, firms with diverse product portfolios – particularly those combining hardware, embedded software, and related technology – underestimate how many distinct CCL entries need to be checked. Software that operates the hardware and technology transferred to enable the customer to use it are separate classification exercises.
Step 3 – Apply the licence determination and confirm any exceptions
Once the ECCN is identified, the classification exercise is only half complete. The ECCN plus the destination country plus the end user and end use together produce the licence determination – whether a licence is required and, if so, whether a licence exception covers the transaction.
Licence exceptions (standing authorisations under the EAR that permit certain transactions without a separate application) are ECCN-specific. Some exceptions are available only for items controlled at lower levels; others depend on the destination. The exporter must confirm that the exception's terms are met in full – and document that confirmation. Using an exception that does not apply is treated the same as exporting without a licence.
The end-use and end-user checks are not optional supplements to the classification. They are part of it. An item that would be EAR99 for a civilian distributor may require a licence for a military end user at the same destination. The Entity List (BIS's list of parties subject to specific licence requirements, separate from the OFAC sanctions lists) must be checked before applying any licence exception.
Cross-border dimension: if the item will be re-exported from a third country, the re-exporter's own jurisdiction may impose a parallel classification requirement. Under EU dual-use rules, for example, a re-exporter in an EU member state must apply the EU CCL to the same item. The EU and US lists are not identical. An item classified under one regime may carry a different control level under the other. We regularly advise clients on these divergences, which are most acute for emerging technologies where the two regimes are updating their lists at different rates.
Step 4 – Document the classification and build a review cycle
A classification decision that cannot be reproduced, explained, and defended in writing is a compliance gap. BIS expects exporters to maintain records of their classification analysis, and those records must be retained for a defined period. Documentation should record: the item's technical parameters, the CCL entries considered and why others were ruled out, the parameters checked, the ECCN assigned, the reasons for control, the licence determination, any exceptions applied, and the date of the review.
Two further documentation elements matter in practice. First, the author of the classification decision should have the technical competence to make it – classification by a logistics team without engineering input is a common audit finding. Second, the review cycle must be defined and followed. Product changes, CCL updates, and changes to Entity List entries all require a reclassification trigger.
The position above covers the standard classification case. Your facts – the product, the destination, the end user, the supply chain structure, and any US-origin technology embedded in a foreign product – change the analysis materially.
For guidance on your specific classification exercise or on building a classification review programme, contact Calder & Vance at info@caldervance.com.
When should a company submit a commodity classification request to BIS?
A commodity classification request (a formal submission to BIS asking the agency to confirm the ECCN for a specific item) is appropriate when the exporter's own analysis produces genuine ambiguity that cannot be resolved by reading the CCL. It is not a routine first step. BIS processes commodity classification requests, but the process takes time that commercial timelines may not accommodate, and the request itself creates a record.
The right candidates for a commodity classification request are: items that sit at the boundary between two CCL entries and where the difference has material licence consequences; items incorporating emerging technology where the applicable CCL entry has not been updated to match current technical parameters; and items where a prior BIS response to a similar item gives only partial guidance.
A commodity classification request is not the same as a licence application. BIS's confirmation of the ECCN does not authorise the export. The licence determination still applies. And a confirmed ECCN can become outdated if the item changes or the CCL is revised. In our practice, we advise clients to treat BIS classification responses as a starting point for an annual review rather than a permanent answer.
One more consideration: where ITAR jurisdiction is genuinely uncertain, the right route is a commodity jurisdiction request to the State Department, not a BIS commodity classification request. Submitting to the wrong agency creates delay and may create regulatory complications. The two processes are distinct and should be initiated with the correct agency from the outset.
Risk flags: where ECCN classification goes wrong
Classification errors cluster around identifiable patterns. Recognising them in advance is more efficient than correcting them after a violation notice.
- Over-reliance on product names. CCL entries are controlled by technical parameters, not commercial descriptions. A product marketed as a "commercial telecommunications device" may carry a National Security control if its data-transfer rate exceeds the CCL threshold.
- Treating EAR99 as permanent. EAR99 status is not a licence or an exemption. It reflects a classification at a point in time. Product updates and CCL changes can invalidate it without notice to the exporter.
- Classifying only the hardware. Technology and software that enable use of a controlled item – design specifications, operating manuals, source code – are subject to separate classification. Shipping the hardware with an EAR99 classification while transferring controlled technology separately is a violation.
- Missing the Entity List check. A clean ECCN and a valid licence exception do not authorise a transaction with an Entity List party. The lists are separate. Screening must cover both.
- No reclassification trigger. Many compliance programmes classify an item once and do not revisit it. Product development cycles that alter performance parameters require a fresh classification analysis. CCL amendments can shift the control level of an existing item without a separate notification to the exporter.
- Ignoring the deemed-export dimension. A deemed export (the transfer of controlled technology or source code to a foreign national in the United States, treated as an export to that person's home country) is subject to ECCN classification and licence requirements in the same way as a physical shipment. This catches technology companies that manage their export compliance entirely through their shipping team.
If a transaction has already been flagged, or a prior classification is now under internal question, an early review preserves options. Voluntary self-disclosure to BIS, where appropriate, is a structured process – but the timing and framing of a VSD (voluntary self-disclosure to a regulator) affect how it is received. We have advised on VSD decisions and preparation in matters where classification errors were identified late.
For a confidential review of a potential classification error or an apparent violation under the EAR, contact us at info@caldervance.com.
How BIS / EAR classification compares to the UK and EU regimes
BIS / EAR classification is the entry point for US export-control compliance, but it does not resolve the picture for a business operating across multiple jurisdictions. The UK and EU regimes impose parallel classification obligations that are structurally similar but not identical in their substance.
Under EU dual-use rules, the applicable Council Regulation and its annexes define a list of controlled goods, software, and technology. The EU list tracks the Wassenaar Arrangement and other multilateral export-control regimes, as does the US CCL – but the two diverge at the margins, particularly for emerging and dual-use technologies. An item that falls below the US control threshold may still be controlled under EU rules, and vice versa. Businesses exporting from EU member states to third markets, or re-exporting US-origin items through the EU, face both sets of obligations simultaneously.
The UK's export-control regime, administered by the Export Control Joint Unit (ECJU), operates a national strategic export licensing list that largely mirrors the EU list (maintained since the UK's departure from the EU) but is updated independently. UK exporters cannot assume that a pre-2021 EU classification determination remains current for UK purposes. UK classification decisions are made under the Export Control Order and the relevant implementing instruments.
What is the practical implication for a multinational? The same physical item may require three separate classification analyses – under the EAR, under EU dual-use rules, and under the UK Export Control Order – before a cross-border transaction can be assessed for licence requirements. Where any one of those classifications identifies a controlled item, the stricter requirement governs the transaction in that jurisdiction. Classification counsel with cross-regime scope produces a consolidated analysis rather than three siloed opinions that may not speak to each other.
Related practices
- Deemed export and technology transfer under BIS / EAR – advice on technology-transfer licence requirements and deemed-export compliance for foreign nationals
- ECCN classification: advanced issues and edge cases – deeper treatment of boundary classifications, CCL amendments, and reclassification triggers
- ECCN classification in cross-border supply chains – how US, EU, and UK classification obligations interact in multi-jurisdiction supply chains