A European technology company has just closed a licensing deal with a US distributor. Its export-compliance team has classified the product under the EU Dual-Use Regulation. But the US counterpart asks a pointed question: what is the item's ECCN (Export Control Classification Number under the US Commerce Control List)? The team pauses. Are the two classifications interchangeable? The answer matters enormously – because the US Bureau of Industry and Security (BIS) administers the Export Administration Regulations (the "EAR"), a wholly independent control regime with its own classification logic, licence requirements, and extraterritorial reach.
As of May 2026, classifying an item under the EU Dual-Use Regulation does not substitute for classification under the EAR. The two regimes use different control lists, different criteria, and different licence-exception structures. A business that relies on its EU classification alone when exporting technology subject to the EAR risks an unlicensed export – a strict-liability violation that BIS enforces with significant civil and, in aggravated cases, criminal consequences.
This guide walks through the EU dual-use classification process as it intersects with BIS / EAR obligations – step by step, regime by regime – and identifies where the two systems diverge most dangerously.
Step 1: Understand the two independent classification regimes
The EU Dual-Use Regulation and the EAR are parallel but not equivalent systems: each demands its own classification analysis, and neither result automatically satisfies the other.
The EU Dual-Use Regulation – adopted under Council authority and administered nationally by member-state competent authorities – controls items listed in its Annex I, organised into ten categories by sector. The EAR, administered by BIS within the US Department of Commerce, controls items listed on the Commerce Control List (CCL), also organised into ten categories. The structural resemblance is intentional: both derive from the Wassenaar Arrangement, the Australia Group, the Missile Technology Control Regime, and the Nuclear Suppliers Group. However, the two lists are not identical, and the classification decisions are made independently.
In our cross-border practice, the most common misconception we encounter is that a "dual-use" label in one regime carries over automatically. It does not. An item that falls outside the EU Annex I may still carry an ECCN under the CCL. An item that is uncontrolled under the EAR (classified as EAR99 – the default classification for items on the CCL that carry no specific ECCN) may still be controlled under EU rules. Mapping across the two lists is a substantive exercise, not a clerical one.
Step 2: Determine whether the EAR applies at all
The EAR's jurisdictional reach is the starting point: if the EAR does not apply to the item or the transaction, the US classification question falls away. But BIS's reach is wider than many exporters assume.
The EAR applies to items subject to the EAR – a defined category that includes items physically located in the United States, items of US origin wherever they are in the world, and certain foreign-produced items that incorporate a defined percentage of controlled US-origin content or that are the direct product of controlled US technology or software. This last category – the foreign direct product rules – is where European businesses most often find themselves unexpectedly within BIS's jurisdiction.
A European manufacturer producing a product using US-origin semiconductor manufacturing equipment, or software developed with controlled US source code, should assess whether the resulting item is subject to the EAR before relying solely on an EU classification. The applicable thresholds and triggers for the foreign direct product rules have been expanded in recent years; verify the current position before relying on any prior analysis. Have you reviewed the supply chain for US-origin inputs, not just the final product's design origin?
In a recent matter, a Northern European electronics manufacturer had classified its modules under the EU Dual-Use Regulation and believed its export obligations were fully addressed. A downstream transaction to a non-European buyer prompted a counterparty's US counsel to raise foreign direct product rule questions. We undertook the jurisdictional analysis, confirmed that several product lines were subject to the EAR by reason of their production process, and worked through the ECCN classification for each. The matter resolved without an enforcement referral.
Step 3: Classify the item on the Commerce Control List
The CCL classification process follows a defined sequence: determine the item's technical parameters, match them against the CCL's ten categories and five product groups, and identify whether any ECCN applies – or whether the item is EAR99.
The CCL's ten categories are numbered 0 through 9, covering nuclear materials and equipment (0), materials, chemicals, micro-organisms and toxins (1), materials processing (2), electronics (3), computers (4), telecommunications and information security (5), sensors and lasers (6), navigation and avionics (7), marine (8), and aerospace and propulsion (9). Within each category, the product groups are A (systems, equipment and components), B (test, inspection and production equipment), C (material), D (software), and E (technology).
Classification begins with the technical specifications of the item as designed and intended to be used – not as marketed. A compliance counsel conducting a CCL review must examine the item against each potentially applicable ECCN entry, paying close attention to the parameters listed in the applicable entry. Performance thresholds, frequencies, materials compositions, and software capabilities all determine whether an entry is engaged.
Where the item does not match any specific ECCN entry, it is classified EAR99. EAR99 items do not require a BIS licence for most destinations, but they remain subject to the EAR in other respects – including destination, end-user, and end-use restrictions under the EAR's general prohibitions. Classifying an item as EAR99 is a substantive conclusion, not a default; it should be documented as such.
We regularly advise clients to retain the technical documentation that supports each classification determination. If BIS later questions the classification, the contemporaneous record is the primary defence. Classification files should capture the parameters reviewed, the entries considered and rejected, and the conclusion reached – with the name of the person responsible and the date.
Step 4: Map the EU and US classifications and identify the gaps
The critical practical step is to map your EU classification against the corresponding CCL category and identify any divergence – because divergence is the zone of risk.
Both control lists share the same Wassenaar category structure at the top level. An item in EU Category 3 (electronics) will generally correspond to CCL Category 3. But the detail matters. Within each category, EU and US entries may specify different technical parameters, different performance thresholds, or different software and technology coverage. An item that falls just below the EU Annex I threshold for a given entry may still fall within the corresponding ECCN's parameters if BIS applies a slightly different test.
The divergence is most pronounced in three areas. First, information security: the EU and the US have at times applied different policy judgments to encryption controls, and the practical licence-exception availability differs. Second, advanced electronics and semiconductors: BIS's controls in this area have been materially tightened, with new ECCN entries and expanded controls that may not yet have a direct EU Annex I equivalent. Third, software and technology: the EU and US definitions of "technology" for export-control purposes are not identical, and the coverage of intangible transfers differs.
Documenting the mapping – EU entry, CCL entry, match or divergence, and the analysis – is good practice and creates a defensible record. Where divergence exists, the stricter obligation governs for the relevant jurisdiction. A business exporting from both the EU and the US is subject to both regimes simultaneously; it must satisfy each independently.
Step 5: Identify the applicable licence requirements and exceptions
Once the ECCN is established, the next step is to determine what licence requirement, if any, applies to the proposed destination, end-user, and end-use – and whether a licence exception is available.
The EAR sets out licence requirements by ECCN and destination in the Commerce Country Chart. For each ECCN, the CCL entry lists the applicable Reasons for Control (national security, nuclear non-proliferation, missile technology, chemical and biological weapons, regional stability, anti-terrorism, encryption items, and others). The Commerce Country Chart then shows, for each country, which Reasons for Control trigger a licence requirement. This two-step matrix is the mechanical core of the EAR licence analysis.
Licence exceptions – standing authorisations to export without a specific licence – are numerous under the EAR. The most commonly applicable in commercial transactions include LVS (low-value shipments), GBS (shipments to cooperating countries), CIV (civil end-users), TSR (technology and software under restriction), and others. Each has specific eligibility conditions. Critically, licence exceptions are not available to all ECCNs and not available to all destinations; they also cannot be used when an end-user or end-use check raises a red flag.
Under the EU Dual-Use Regulation, the licence structure differs. The EU provides EU General Export Authorisations (EUGEAs) covering exports of specific items to specific groups of destinations, alongside national general licences, global licences, and individual licences issued by member-state competent authorities. The procedural steps to obtain an individual licence under the EU regime are handled through the relevant member-state authority; the steps under the EAR are handled through BIS's electronic filing system. The two processes run in parallel for a dual-jurisdiction transaction.
What happens when a licence exception is technically available but the transaction involves an end-user whose ownership or affiliation raises concerns? The EAR's general prohibitions and the Entity List, Denied Persons List, and Unverified List create restrictions that override licence exceptions. This is where end-user screening intersects classification – and where a classified item that would otherwise fall under an exception becomes unlicensable without further diligence.
Step 6: Conduct end-user and end-use screening
Classification and end-user screening are distinct obligations, but they interact: the correct classification determines the licence requirement, and the end-user screening determines whether any available exception or licence can lawfully be used.
BIS maintains three restricted-party lists of direct relevance to export transactions. The Entity List names foreign persons subject to specific licence requirements for items that would otherwise be EAR99 or covered by an exception. The Denied Persons List names those with whom all EAR-covered transactions are prohibited. The Unverified List names parties whose bona fides BIS has been unable to verify; exporters dealing with unverified-listed parties may not use licence exceptions.
Screening against these lists is a baseline requirement, not an optional diligence step. In our experience, exporters who have correctly classified an item and identified an available licence exception have still faced BIS scrutiny because their screening failed to identify an Unverified List party in the transaction chain.
The EU regime operates a comparable screening requirement. The EU Dual-Use Regulation requires exporters to conduct due diligence on end-users and to assess end-use declarations. The EU's consolidated list of asset-freeze targets and the UN Consolidated List feed into the end-user screen, as does OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons) for any US-nexus transaction. A full cross-regime screen therefore covers EU restricted parties, UN Security Council-designated persons, BIS lists, and OFAC's SDN List at a minimum.
Step 7: Document the classification and build the record
A classification determination is only as defensible as the contemporaneous record that supports it. This final step is where many businesses invest too little.
Best practice for a BIS / EAR classification record includes: the item description with full technical specifications; the CCL category and product group considered; each ECCN entry reviewed and the reasons it was accepted or rejected; the final ECCN or EAR99 conclusion; the Reasons for Control identified; the Commerce Country Chart analysis for the proposed destination; the licence exception or licence requirement identified; the end-user and end-use check results; and the name, role, and date of sign-off.
Under the EAR, exporters are required to retain export-related records for a defined period. Verify the current retention period against the EAR's requirements; the standard is several years from the date of the export or the related document, whichever is later. Failure to maintain adequate records is itself a violation.
An equivalent documentation obligation applies under the EU Dual-Use Regulation. Member-state competent authorities can request documentation of classification and licensing decisions; the records must support the decision made at the time. Maintaining parallel EU and US classification files – cross-referenced and consistent – is the approach we recommend for businesses operating under both regimes.
Cross-border risk: where EU and BIS / EAR obligations collide
The most acute risk in dual-jurisdiction classification is not getting one regime wrong in isolation – it is acting on one regime's analysis without recognising that the other regime may require a different outcome.
Consider a European exporter shipping controlled technology to a buyer in a third country. The exporter holds an EU individual licence. It believes its obligations are met. But the technology is also subject to the EAR by reason of US-origin components. BIS has not issued a licence. The export proceeds. From the EAR's perspective, this is an unlicensed export – regardless of what the EU authority approved.
Conversely, an EU exporter may conclude that an item is EAR99 and therefore freely exportable under the EAR to most destinations. But the same item may be controlled under EU Annex I and require a national individual licence. Acting on the EAR99 classification alone, without the EU analysis, produces an unauthorised EU export.
The practical rule is this: where both regimes apply, work through each independently. Do not use one regime's result as a shortcut for the other. Compliance counsel advising on these transactions routinely see enforcement exposure that traces directly to the mistaken assumption that one classification satisfies both regimes. Is your classification process structured to produce two independent, documented results – one for BIS / EAR and one for EU?
There is also a secondary-sanctions dimension. Where a transaction involves a party subject to OFAC sanctions, the EAR export may be technically classifiable and licensable, but the underlying financial transaction may be blocked. US dollar clearing, US correspondent banking, and the involvement of US persons anywhere in the chain can bring OFAC's prohibitions into play even where BIS has no objection. Compliance counsel handling dual-use classification must maintain situational awareness of OFAC's SDN List and the relevant programme restrictions simultaneously.
The position above covers the standard case. Your facts – the item's technical parameters, the origin of its components, the route, the end-user, and the regimes in play – change the analysis materially.
To discuss a classification question or a cross-regime review, contact Calder & Vance at info@caldervance.com.
Common mistakes and risk flags in dual-use classification
Classification errors cluster around a handful of recurring patterns. Recognising them early is the most effective risk-reduction step.
The first is reliance on the EU classification as a proxy for the CCL analysis. As set out above, the two lists are not the same. The structural overlap creates a false sense of equivalence. Every US-nexus transaction requires an independent CCL classification.
The second is failing to assess whether the foreign direct product rules bring an item within EAR jurisdiction. European manufacturers often focus on final-product origin and miss the supply-chain inputs that may trigger US jurisdiction over the finished item.
The third is treating EAR99 as a licence-free pass. EAR99 items are still subject to EAR-general prohibitions, end-user and end-use restrictions, and Entity List licence requirements. Classifying an item as EAR99 and then shipping without an end-user screen is a recurring source of violation.
The fourth is failing to re-classify when a product changes. A software update, a new component, or a change in operating parameters can alter an item's classification. Static classification files that are not reviewed when the product evolves create stale determinations that no longer reflect the actual item being exported.
The fifth is applying the wrong product group. An item correctly placed in CCL Category 3 may be misassigned to product group A (equipment) when the primary control applies to product group E (technology) for the related know-how. The product group affects which Reasons for Control apply and therefore which licence exceptions are available.
If a shipment has already been made on a questionable classification, or a compliance review has surfaced a potential error, an early assessment can preserve the option of a VSD (voluntary self-disclosure to a regulator) – an option that narrows with time and that BIS treats as a significant mitigating factor in enforcement proceedings.
If a transaction has already been flagged, or a prior classification is under question, an early review can preserve options that narrow with time. Contact info@caldervance.com for a confidential review.
A common misconception: "our EU authorisation covers the US side"
The myth is widespread and understandable: the EU and US dual-use control lists share a common Wassenaar origin, so surely an EU authorisation should carry weight with BIS? It does not – at least not in the sense of substituting for a BIS licence or exception.
BIS administers US law. An EU general export authorisation or an individual licence issued by a member-state competent authority is a foreign regulatory act. It is legally irrelevant to the EAR analysis. BIS neither recognises EU licences as equivalents nor accepts them in place of the required EAR licence. Where a BIS licence is required and no exception applies, the absence of a BIS authorisation is a violation – regardless of what any other jurisdiction has approved.
The reverse is equally true. An OFAC General Licence issued under a US sanctions programme does not authorise a transaction that requires an EU export licence. Each regime's authorisations operate within their own legal system. For a cross-border transaction that touches both regimes, the business must hold the required authorisation under each regime independently.
In our experience advising export-intensive businesses, the fastest way to close this gap is a structured dual-classification protocol: one process, two parallel tracks, with sign-off required from both before the shipment is released.
Related practices
- Deemed export and technology controls under BIS / EAR – advising on US technology transfer restrictions for foreign nationals and intangible releases
- EU dual-use classification under the EU Dual-Use Regulation – step-by-step guide to classifying items under EU Annex I and obtaining EU authorisations
- EU dual-use classification: advanced topics – brokering controls, catch-all provisions, and member-state divergence