A technology company ships a product to a distributor in a third country. The goods were classified internally as EAR99 – no licence required. Six months later, a BIS audit reveals that the item contains a controlled parameter that places it squarely on the Commerce Control List. The shipment violated the Export Administration Regulations. The company had no idea.
An ECCN (Export Control Classification Number, the alphanumeric code under the US Commerce Control List that determines whether an item requires a licence for export) is not a self-evident fact about a product. It is a legal conclusion reached by matching the item's technical parameters against a controlled-item list. As of April 2026, that analysis must be performed correctly before each export – and for a business with a cross-border footprint, it must be performed under multiple regimes simultaneously.
This guide walks through the classification process step by step, compares the US approach with the EU dual-use rules and the UK export-control regime, and identifies the risk flags that most commonly produce enforcement exposure.
Step 1 – Understand what the classification question actually asks
Classification asks a single question: does this item, in its current form, match an entry on a controlled-item list? The answer determines whether a licence is required and, if so, under which conditions. Getting the question right before attempting an answer avoids most misclassifications.
Under the US Export Administration Regulations, administered by BIS (the Bureau of Industry and Security within the Department of Commerce), every physical item, software, and piece of technology has a classification. Items that do not match any positive entry on the Commerce Control List are designated EAR99 – a residual category, not a confirmation of zero risk. Even EAR99 items can require a licence when the end-user, end-use, or destination triggers a separate control.
The EU operates a parallel system under its dual-use regulation. The EU list tracks the multilateral export-control regime lists – the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group, and the Missile Technology Control Regime. UK export controls, administered by ECJU (the Export Control Joint Unit), maintain a domestic list that closely follows the EU structure but is now independently maintained post-Brexit. These three regimes use similar list architectures but differ in thresholds, catch-all controls, and enforcement cultures.
A compliance counsel advising a cross-border business therefore needs to run three separate classification analyses against three separate lists. Alignment is common. Divergence is not rare.
Step 2 – Gather the technical specification package
Classification is only as good as the technical data it rests on. Before any list-matching exercise begins, the practitioner must assemble a complete specification package for the item.
That package should cover the item's function and application, all performance parameters (speed, frequency, wavelength, tensile strength, or whatever characteristic the relevant control list entry uses), the software or technology that accompanies or enables it, and any modifications that post-date the original design. A product that was correctly classified as EAR99 in one version may move to a positive ECCN in the next version if a controlled parameter is introduced.
In our experience, the specification package is the single point where cross-border classification exercises break down. Engineering teams describe products in commercial terms. Control lists are written in technical parameters. Bridging that language gap requires someone who understands both – and who knows which parameter the list entry targets.
The EU and UK lists use the same parameter structure as the US lists in most categories, because all three track the same multilateral regime texts. But the EU and UK catch-all controls extend to items not on any positive list when the exporter knows or suspects a prohibited end-use or end-user. The US EAR contains comparable end-use and end-user controls. A complete technical package supports all three analyses at once.
Step 3 – Match the item to the list, layer by layer
List-matching under the Commerce Control List is a three-layer exercise: category, product group, and reason for control. Each matters because each shapes the licence requirement and the available exceptions.
The Commerce Control List is organised into ten categories (from Category 0, nuclear materials, to Category 9, aerospace and propulsion) and five product groups within each category (equipment, test and inspection equipment, materials, software, and technology). An ECCN entry is written as a combination of these: 5E002, for instance, sits in Category 5 (telecommunications and information security), Product Group E (technology).
The reason-for-control column is equally important. An entry controlled for national-security reasons triggers different licence requirements than one controlled for anti-terrorism, missile technology, or nuclear non-proliferation purposes. The destination of the export interacts with the reason for control to determine whether a licence exception is available or whether a licence application is required.
Under EU rules, the classification exercise maps onto a similar structure. Under UK rules, the ECJU applies the UK Strategic Export Control List, which mirrors the international regime lists. Where a UK entry and an EU entry describe the same item, a business exporting the same product from both the UK and the EU will generally reach the same classification – but must apply for licences from two separate authorities.
Does your classification exercise document each layer, or does it record only the final ECCN? An incomplete record is almost as risky as an incorrect one.
Step 4 – Apply the cross-regime comparison and identify divergence points
The most operationally significant step in a cross-border classification exercise is identifying where the US, EU, and UK analyses diverge – because divergence creates the gap where enforcement exposure lives.
Three divergence patterns appear most frequently in our cross-border practice.
The first is threshold differences. A software package may fall below the performance threshold for a positive US control list entry but exceed the threshold in an EU or UK entry, or vice versa. This can mean that an item freely exportable from the US requires a licence from an EU member-state authority or from ECJU.
The second is the treatment of technology. Under the EAR, deemed export rules treat the transfer of controlled technology to a foreign national in the United States as an export to that person's home country, requiring a licence in some cases. The EU and UK apply comparable but not identical principles to technology transfers. For a company with multinational engineering teams, this divergence has immediate operational consequences.
The third is the scope of catch-all controls. All three regimes maintain controls that apply to items not on any positive list when the exporter has knowledge of a prohibited end-use or end-user. But the knowledge thresholds, the red-flag indicators, and the available defences differ between regimes. An exporter relying on a US due-diligence standard may not satisfy the EU or UK standard for the same transaction.
Secondary sanctions add a further layer. A transaction that is properly licensed under the EAR may still carry OFAC exposure if a counterparty or an intermediate party is a Specially Designated National (a person on OFAC's SDN List whose assets are blocked and with whom US-linked persons may not transact). For a non-US company, secondary-sanctions risk under OFAC can affect the transaction even if the company has no direct US nexus. Sanctions and export controls are parallel regimes; they must be run in parallel.
The position above covers the standard classification case. Your facts – the item's parameters, the destination, the end-user, and the regime in play – change the analysis. For an assessment of your export-control exposure across regimes, contact Calder & Vance at info@caldervance.com.
Step 5 – Document the classification determination and set a review cycle
A classification determination is a legal position. It should be documented as one. An undocumented classification is not a defence in enforcement proceedings; it is an absence of a defence.
The documentation should record the item description, the specification parameters relied upon, the list entries considered and rejected, the final classification reached under each applicable regime, the name of the person responsible for the determination, and the date. Where the analysis is borderline – where a parameter is close to a list threshold, or where a catch-all control may apply – the reasoning for the conclusion reached should be set out explicitly.
Record-keeping obligations under the EAR require exporters to maintain export records for five years from the date of export or the date of any licence application, whichever is later. UK and EU obligations impose comparable retention requirements. A classification file that cannot be produced to an auditor or a regulator carries the same risk as a file that was never created.
Classification is not a one-time exercise. Products change. Control lists are updated, sometimes significantly, when multilateral regime negotiations produce new technical parameters. A product classified correctly in one year may be mis-classified two years later if a list update has not been tracked. We regularly advise exporters to build a structured annual review of their product classification register into their compliance calendar.
Step 6 – Identify risk flags and decide when to involve counsel
Certain fact patterns reliably signal that a classification exercise carries elevated risk and warrants specialist input before the export proceeds.
The first risk flag is a product with parameters that are close to a control list threshold. "Close" is not a safe margin; list thresholds are hard lines, not zones. If a performance specification sits within ten percent of a threshold, the determination should be reviewed against the current version of the list, not the version current at the time of the original classification.
The second is a product that combines hardware, software, and associated technology in a single commercial package. Each element may have a different classification. The combined package may trigger a higher-category control. The software and technology may be subject to deemed-export or deemed-re-export rules that affect the technical team as well as the shipping department.
The third is a new destination or end-user. An ECCN determines what licence is required; the destination and end-user determine whether that licence is available as an exception or must be applied for individually. A product correctly classified as 5E002 may be exportable to one destination under a licence exception and require a formal application for another.
The fourth is a change in the product itself. An engineering modification that improves a performance parameter can move an item from EAR99 to a positive ECCN or from one ECCN to a more sensitive one. Classification reviews should be triggered by any product release cycle, not only by compliance department audits.
If a transaction has already been flagged – by a freight forwarder, a bank, a government query, or an internal audit – an early review can preserve options that narrow with time. For a confidential review of a potential classification issue or apparent violation, contact us at info@caldervance.com.
Step 7 – Address the common myth: "If it's not on the list, it's free to export"
The most persistent misconception in cross-border export compliance is that an EAR99 classification – or the equivalent residual category under EU or UK rules – means the item is freely exportable to any destination without further analysis. That is incorrect, and acting on it creates serious enforcement risk.
An EAR99 item can require a licence when the end-user is on the Entity List (BIS's list of persons subject to enhanced licence requirements), the Denied Persons List (persons barred from receiving US exports), or OFAC's SDN List. It can require a licence when the exporter has reason to know the item will be used in a prohibited programme. Under EU and UK catch-all controls, the same item can be controlled when the exporter knows or has been informed that the item will be used in connection with certain weapons-related activities.
In our practice, we have acted for exporters who discovered that a product they had exported as EAR99 was subject to a catch-all control because of information they held about the end-user's activities. The classification of the item did not insulate them from the catch-all analysis. These are separate questions. A compliance programme that stops at item classification and does not run an end-user and end-use analysis is incomplete.
The residual category is a starting point, not a destination.
Related practices
- Deemed export and technology controls under BIS/EAR – advising on technology transfer, deemed-export licence requirements, and end-use controls for cross-border businesses.
- ECCN classification cross-border guide: part 2 – deeper analysis of licence exceptions, end-use checks, and post-shipment verification across regimes.
- ECCN classification cross-border guide: part 3 – advanced topics including deemed re-export, encryption controls, and the interaction between export controls and financial sanctions.