A technology manufacturer based in Germany prepares to ship a batch of signal-processing boards to a systems integrator in a third country. The goods are assessed against the EU dual-use regulation, a licence is not required, and the shipment leaves. Three months later, the company receives a query from a US counterparty: were the boards controlled under the Export Administration Regulations (the EAR, the US Commerce Department's rules governing exports, re-exports, and transfers of items subject to US jurisdiction)? The question triggers an internal review – and the review reveals that the boards contained US-origin integrated circuits that nobody had mapped.
As of May 2026, any item that incorporates US-origin technology, software, or components above a defined de minimis threshold remains subject to the EAR regardless of where it is manufactured or shipped. The EU dual-use regime and the US EAR are parallel obligations, not alternatives. A classification that satisfies one regime can still leave a business exposed under the other. Cross-border businesses must therefore run both analyses, in sequence, before any controlled shipment leaves.
This guide sets out the classification procedure under both regimes, identifies the most common gaps between them, and explains when specialist export-control counsel should be involved.
Step 1: Understand the two parallel classification systems
The first step is to recognise that the EU dual-use regime and the US EAR are independent legal systems with overlapping but not identical scope, and that compliance with one does not discharge obligations under the other.
The EU dual-use regime is administered by competent national authorities in each Member State, acting within the structure set by the relevant EU Council regulation on the control of exports, brokering, and transit of dual-use items. That regulation governs items listed in its Annex I, which tracks the multilateral control lists agreed in export-control arrangements such as the Wassenaar Arrangement, the Nuclear Suppliers Group, and the Australia Group. An item not listed in Annex I may still require a licence under a catch-all provision if the exporter knows or suspects end-use for weapons of mass destruction or military end-use by an embargoed destination.
The US EAR is administered by the Bureau of Industry and Security (BIS) within the US Department of Commerce. The EAR controls items that are either enumerated on the Commerce Control List (CCL, the catalogue of controlled items each assigned an Export Control Classification Number or ECCN) or that fall within the broad residual category of EAR99 items – goods subject to the EAR but not specifically listed. Even EAR99 items require a licence for certain destinations, end-users, and end-uses. The reach of the EAR extends beyond the United States through the de minimis rule and the foreign direct product rule (FDPR, a rule that subjects foreign-made items to the EAR when they are produced using certain US technology or software, or by specified US-origin production equipment).
In our cross-border practice, businesses most often assume that clearing the EU regime ends their obligations. That assumption breaks down the moment a US-origin component, a piece of US-developed software, or a chipset fabricated on US-origin tooling enters the supply chain.
Step 2: Determine whether the EAR applies to your item
The second step is to assess whether the EAR has jurisdiction over the item at all – a question that arises even when the exporter is not a US entity and the item is not physically located in the United States.
The EAR applies to items that are "subject to the EAR." That category includes items located in the United States, items of US origin wherever located, and foreign-made items that meet either the de minimis test or the FDPR. The de minimis rule brings a foreign-made item within EAR jurisdiction when it contains controlled US-origin content whose value exceeds a defined percentage of the total item value – the applicable percentage varies depending on the destination involved, so verify the current threshold against the relevant CCL category before relying on a particular figure.
The FDPR is broader and more technically demanding. It can subject a foreign-made item to the EAR even when US-origin content is negligible by value, provided the item was produced by or with certain US-origin technology or manufacturing equipment. BIS expanded the FDPR's reach in recent years, and the current rules are significantly more extensive than those that applied a decade ago.
Practical questions to ask at this step:
- Does the item contain any US-origin hardware, software, or firmware, at any tier of the supply chain?
- Was any production equipment used to manufacture the item designed with US-origin technology?
- Has a US person provided technical assistance, design services, or software in relation to the item's development?
- Is any software incorporated in the item subject to a US licence or US copyright?
A "yes" to any of these questions opens the EAR analysis. It does not automatically require a licence, but it means the EAR applies and its requirements must be assessed.
The position above covers the standard case. Your specific item – its components, its production history, its destination, and the end-user profile – will shape the analysis materially. For an assessment of your EAR exposure, contact Calder & Vance at info@caldervance.com.
Step 3: Classify the item under the CCL and identify the ECCN
Once EAR jurisdiction is confirmed, the next step is to determine the item's ECCN (Export Control Classification Number under the US Commerce Control List), which controls what licence requirements apply and which exceptions may be available.
The CCL is organised into ten categories – from nuclear materials and electronics through to aerospace and propulsion. Within each category, items are further divided by product group: equipment, materials, software, technology, and systems. An ECCN consists of a number identifying the category and a letter identifying the product group, followed by three further characters indicating the reason for control.
To classify correctly:
- Identify the primary function of the item and the category it naturally falls within.
- Review the relevant entries across all applicable categories, since a single item may technically fall within more than one.
- Apply the technical parameters specified in the entry: performance thresholds, material specifications, operating frequencies, and similar characteristics all matter.
- Determine whether any applicable "specially designed" language captures the item even if it does not meet a numerical threshold on its face.
- If no specific ECCN applies, classify the item as EAR99 – but do not treat EAR99 as a clean clearance without reviewing destination and end-use restrictions.
Classification errors at this step are consequential. An item misclassified as EAR99 when it carries an ECCN with national-security or anti-terrorism controls may require a licence for a transaction that the exporter assumed was licence-free. Conversely, over-classification delays shipments and erodes commercial relationships unnecessarily.
How does this compare to the EU classification process? Under the EU regime, the exporter maps the item against the Annex I list, which is also organised by Wassenaar-aligned categories and technical parameters. The categories and numerical thresholds often track each other, but they are not identical. A controlled classification under one regime does not guarantee a controlled classification under the other, and – critically – the control reasons can diverge. An item controlled for anti-terrorism reasons under the EAR may carry different destination and end-use restrictions from those applying under the EU regime. Running the two analyses in parallel at the same technical mapping stage is more efficient than treating them as sequential.
Our practice covers both regimes. We regularly advise on classification disputes and commodity-jurisdiction requests where the technical parameters are contested, and on EU Annex I mapping for items already classified under the CCL.
Step 4: Assess licence requirements and available exceptions
Classification alone does not determine whether a licence is needed: the fourth step is to apply the ECCN's reason-for-control codes against the destination, the end-user, and the end-use of the particular transaction.
Each ECCN entry specifies one or more reasons for control, abbreviated as RS (regional stability), NS (national security), AT (anti-terrorism), MT (missile technology), CB (chemical and biological), NP (nuclear non-proliferation), CC (crime control), and others. Each reason-for-control code generates a set of Country Chart entries, and the Country Chart indicates whether a licence is required for a given destination.
Even where the Country Chart indicates a licence requirement, a licence exception may be available. Licence exceptions are standing authorisations under the EAR that permit certain transactions without a specific licence application, provided the conditions of the exception are met. Common exceptions include those applicable to low-value shipments, certain technology transfers, and transactions between entities in close-partner jurisdictions. The conditions are item-, ECCN-, and destination-specific. Misapplying an exception is treated as a violation, not a compliance effort, so the conditions must be verified precisely.
Under the EU dual-use regime, an equivalent assessment applies. The EU regime uses a series of Union general export authorisations (standing authorisations for defined destinations and item categories), national general authorisations granted by individual Member States, and individual licences issued on a case-by-case basis. The EU general authorisations do not map one-to-one onto the EAR exceptions: an item qualifying for a licence exception under the EAR may still require an individual licence under the EU regime for the same transaction, and vice versa.
Is the end-user or the end-use itself controlled? The EAR prohibits exports to persons on the Entity List (a BIS list of foreign persons subject to licence requirements beyond those that would otherwise apply) and to persons on the Denied Persons List, regardless of ECCN. The EU regime similarly applies catch-all controls based on end-use knowledge, particularly for military and WMD-related programmes. Both sets of end-user checks must be completed for every transaction, not only for items that are individually listed.
If a transaction has already been flagged – a shipment held, an end-user query received, or a filing refused – an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
How does BIS / EAR differ from the EU dual-use regime on key classification questions?
The two regimes share a common lineage in the Wassenaar Arrangement and related multilateral lists, but they diverge in ways that matter operationally for any cross-border business.
Jurisdictional reach. The EAR applies extraterritorially through the de minimis and foreign direct product rules. The EU regime does not apply to goods entirely outside the EU, and it does not carry an equivalent product-rule mechanism. A non-EU exporter shipping entirely within a third country therefore faces EAR obligations (if the goods are subject to the EAR) but no EU obligations in respect of that third-country shipment. Conversely, an EU-based exporter shipping US-origin goods faces both regimes simultaneously.
Technology controls and deemed exports. The EAR controls the release of controlled technology to a foreign national within the United States as an "export" – a concept known as a deemed export (the treatment of a technology transfer to a foreign national as if it were an export to that person's home country). The EU dual-use regulation addresses technology transfer and brokering, but the deemed-export mechanism as a category does not exist in the EU regime in the same form. Businesses hiring non-EU or non-US nationals in technical roles, or granting system-level access to foreign nationals, face distinct obligations under each regime. The firm's companion service on deemed exports is covered at Deemed Export / Technology – BIS / EAR.
Catch-all controls. Both regimes include catch-all provisions, but they are triggered differently. Under the EAR, a red-flag rule requires exporters to investigate suspicious indicators and imposes an obligation not to proceed when there are grounds to know that an end-use or end-user is prohibited. The EU catch-all under the relevant regulation applies when the exporter is informed by competent authorities or knows that the items are intended for certain proscribed programmes, and extends to items not listed in Annex I where there are concerns about military end-use in embargoed destinations. The EU catch-all was significantly expanded by legislative amendments and is now broader in territorial and end-use scope than it was at the regulation's inception.
De-control thresholds. Technical thresholds in the EU Annex I and the CCL are generally aligned because both track Wassenaar, but alignment is not identity. Thresholds can diverge where national-security controls specific to one regime apply, or where one regime has been amended to track a more recent multilateral consensus that the other has not yet incorporated. Always map the item against the current version of each list independently rather than relying on the other list's classification as a proxy.
For a detailed EU-side analysis, including EU Annex I mapping and the Member State authorisation procedures, see EU dual-use classification – EU guide. For the next guide in this series, covering advanced classification scenarios under the EAR, see EU dual-use classification under BIS / EAR: guide 4.
What are the principal risk flags in EU dual-use classification under BIS / EAR?
Classification errors compound. A wrong ECCN at the outset propagates through every subsequent licence-requirement assessment, every exception check, and every record-keeping entry. The risks are preventable, but only if they are identified before the shipment leaves.
The most common risk flags we observe in practice are:
- Reliance on a supplier's classification without independent verification. A supplier's ECCN or EAR99 self-classification is useful as a starting point, but it is not a defence. The exporter or re-exporter bears the responsibility for its own classification determination. In a recent matter, a precision-engineering business classified a component as EAR99 on the basis of a supplier's declaration, without verifying the technical parameters against the relevant CCL entries. The parameters placed the component within an enumerated ECCN with national-security controls. A licence was required for the destination. The error was identified during an internal review before enforcement contact, but the resulting voluntary self-disclosure process consumed substantial compliance resource.
- Treating EU licence clearance as EAR clearance. As noted above, the regimes are parallel, not sequential. EU authorisation does not authorise a re-export that triggers EAR obligations.
- Incomplete supply-chain mapping for de minimis and FDPR purposes. The FDPR and de minimis analyses require a detailed understanding of the item's production history, not just its current specification. Components sourced from sub-tier suppliers may carry US-origin exposure that does not appear in the final product documentation.
- Failure to apply catch-all controls to unlisted items. A business that clears a low-parameter item through a standard classification review may overlook red flags about end-use. If a customer's order pattern, stated end-use, or destination profile raises concerns, the catch-all analysis is mandatory regardless of ECCN or EAR99 status.
- Outdated classification decisions. The CCL and the EU Annex I are updated periodically to reflect changes in multilateral control list decisions. A classification that was correct two years ago may no longer be correct. Classification records should be reviewed whenever an item is modified and whenever a relevant list is amended.
A myth that compliance teams sometimes carry is that the EAR only affects US companies. It does not. The EAR's extraterritorial reach through the de minimis and FDPR rules means that a European, Asian, or Middle Eastern business can be subject to BIS jurisdiction in respect of specific items, re-exports, and transfers, even where the company has no US presence and the goods never enter the United States. Any business that sources technology from the United States, uses US-developed production equipment, or incorporates US-origin software must assess EAR applicability as a standing part of its export-control programme, not as an exceptional circumstance.
When should a business involve export-control counsel?
Early involvement of export-control counsel is consistently more cost-effective than retrospective remediation, and the decision points are identifiable in advance.
Counsel should be involved:
- At the product-development stage, when new items are being specified and supply chains are being structured. Classification and FDPR exposure can often be managed by design decisions at this stage – not to evade controls, but to understand the regulatory position before commercial commitments are made.
- When a business is acquiring or integrating a new entity and needs to map the target's export-control obligations and classification history as part of due diligence.
- When a shipment has been flagged, a query has been received from a national export authority or from BIS, or an internal review has identified a potential misclassification.
- When a business is entering a new market, adding a new product line with dual-use characteristics, or onboarding a counterparty in a jurisdiction with elevated end-use concerns.
- When a voluntary self-disclosure is under consideration. A VSD (voluntary self-disclosure to BIS of a possible EAR violation) can mitigate penalties, but its scope, timing, and content require careful legal judgment. An incomplete or incorrectly scoped VSD may be treated as an admission of broader conduct than was intended.
We have acted for exporters, technology companies, and trading businesses across the spectrum of export-control matters – from classification advisory and licence applications through to enforcement defence and VSD preparation. Our practice covers both the EAR and the EU dual-use regime, which means we map the position under both systems in a single engagement rather than requiring separate instruction of US and EU specialists.
Related practices
- Deemed Export / Technology – BIS / EAR – advice on US deemed-export controls for technology transfers to foreign nationals
- EU dual-use classification under BIS / EAR: guide 4 – advanced EAR classification scenarios and licence exception analysis
- EU dual-use classification – EU guide – EU Annex I mapping and Member State authorisation procedures