A European technology exporter signs a distribution agreement with a partner in a third country. The goods – software tools with cryptographic functions – have been shipped before under an internal classification marked "not listed." A routine customs review flags a potential mismatch. Did the original classification hold up? Is a licence required? The answers depend on a disciplined reading of the EU dual-use rules, and an incorrect classification can expose the exporter to enforcement action with no ability to undo past shipments.
EU dual-use classification is the process of determining whether a specific item – goods, software, or technology – falls within the EU Dual-Use Regulation (the principal Council regulation governing export controls on dual-use items within the EU) and, if so, which control-list entry applies. As of May 2026, that regulation operates alongside national licensing authorities in each Member State and the Export Control Classification Number – known as an ECCN under the US Commerce Control List, but referred to in the EU regime by its control-list entry reference – determines what licence, exception, or exemption may apply. A misclassification is not a minor administrative error; it is a potential violation that can trigger licence revocation, civil penalties, and, in serious cases, criminal referral.
This guide walks through the classification process step by step: from identifying the competent authority to stress-testing the result against the cross-regime extraterritorial risk that many EU exporters underestimate. Each step pairs the EU position with the US EAR and UK export-control regimes to surface divergences that matter for cross-border supply chains.
Step 1: Identify the competent authority and the legal basis
The EU Dual-Use Regulation establishes the single legal basis for export controls across Member States, but licensing and classification decisions remain with the national competent authority of the Member State from which the export takes place. In France it is the SBDU within the Directorate-General of Customs; in Germany it is BAFA; in the Netherlands the Ministry of Foreign Affairs; and so on. The regulation is directly applicable in all Member States, but enforcement and licensing practice differ.
Why does this matter at the classification stage? Because a formal classification ruling – where available – is issued by the national authority, not by the European Commission centrally. Before beginning a classification exercise, exporters must confirm which Member State's authority has jurisdiction over the specific transaction. For goods manufactured and exported from one Member State, this is straightforward. For goods that transit, are assembled across borders, or are transferred within the EU before leaving, the picture is more complex and warrants early advice.
The regulation covers the export of dual-use items, their brokering, technical assistance, and – critically – the provision of technology and software by electronic means, including cloud delivery. The scope is broader than many exporters assume. In our experience, technology-sector businesses frequently under-classify software because they equate "export" with a physical shipment. The regulation does not make that distinction.
Step 2: Screen the item against the EU control list – the classification test
Dual-use items in the EU are controlled through a list that mirrors the multilateral arrangements of the Wassenaar Arrangement, the Nuclear Suppliers Group, the Australia Group, and the Missile Technology Control Regime. The list is structured into ten categories – from Category 0 (nuclear materials) through Category 9 (aerospace and propulsion) – and within each category by control type: systems and equipment (A), test and production equipment (B), materials (C), software (D), and technology (E).
The classification test proceeds in three sequential questions:
- Does the item meet the technical parameters of any entry? This is a specification comparison. The item's technical characteristics – performance, range, frequency, throughput, encryption key length, metallurgical composition, or biological agent – are measured against the list entry's parameters. If the item does not reach any threshold, it is not listed and an Export Control Classification Number does not apply under the EU list.
- Does a decontrol note or general note apply? The list contains general notes (the General Technology Note, the General Software Note, and the General Note for the use of Items) that narrow or exclude coverage. An item may meet the technical threshold of a parameter but still fall outside control if a decontrol note applies. These notes are among the most frequently misread elements of the list.
- If not listed, is a catch-all control triggered? Even items outside the control list can require a licence if the exporter knows or has been informed that they are or may be intended for use in weapons of mass destruction programmes or certain military end-uses. The catch-all is a separate legal basis and operates independently of list classification.
Each question is discrete. Answering "not listed" to Question 1 does not end the analysis. Practitioners who stop at the first question and do not consider the catch-all controls are one of the more common risk patterns we see in compliance reviews.
Step 3: Apply the General Technology Note and the General Software Note
The General Technology Note (GTN) is the rule that limits technology controls to technology that is "required for" the development, production, or use of a controlled item. Technology that is already in the public domain, that constitutes basic scientific research, or that is the minimum necessary for patent applications is carved out. The GTN applies across all technology entries in the list. Exporters who provide training, engineering support, or installation services alongside a product shipment often overlook that the accompanying technology may be separately controlled or, equally, carved out by the GTN.
The General Software Note (GSN) excludes from control software that is generally available to the public – sold from stock in retail, not subject to post-sale restriction on further sale, and designed for installation by the user without further substantial support from the supplier. Cloud software delivered as a service, software bundled with customisation contracts, and software subject to export restrictions embedded in a licence agreement may not qualify. In our cross-border practice, cloud-delivered software is a recurring source of misclassification: the GSN appears to offer a carve-out, but the service wrapper defeats it.
A clean classification note should document the GTN and GSN analysis explicitly, not just record the conclusion. If the documentation ever needs to support a voluntary self-disclosure or an enforcement response, the trail of reasoning is as important as the answer.
Step 4: Assess the end-use and catch-all obligations
Even a confirmed negative classification – the item does not appear on the EU control list – does not release the exporter from the catch-all controls embedded in the EU Dual-Use Regulation. If the exporter knows or has been informed by the competent authority that the item is or may be intended for use in connection with chemical, biological, radiological, or nuclear weapons, or in certain conventional military programmes in destinations subject to an arms embargo, a licence is required regardless of list status.
The catch-all is also engaged by red flags. A competent exporter has a duty to enquire. Red-flag indicators – a buyer whose business profile does not match the item, an end-use certificate that is inconsistent, a request for unusual shipping or payment terms, or a destination that does not align with the stated buyer's operations – must trigger a formal end-use review, not a routine order process. Failure to conduct that review when red flags are present is, under most national enforcement practice, treated as at least negligence, and sometimes as wilful blindness.
Does your current classification process include a documented end-use review step, distinct from the list-screening step? The two are separate legal obligations, and many compliance programmes conflate them into a single pass.
The position under the ECJU in the UK is closely aligned: the UK's retained dual-use regulation, following exit from the EU, preserves the same structure, including catch-all controls. The primary divergence is administrative – the competent authority is now ECJU, and open general export licences issued by ECJU are separate instruments from any EU general export authorisation. A business that previously relied on a single EU authorisation for goods shipped from both a French and a UK facility now requires separate assessments for each jurisdiction.
Step 5: Document the classification and build the audit trail
Classification is not a one-time exercise. It is a living determination that must be reviewed whenever the item's technical specifications change, when the control list is updated, or when the end-use circumstances evolve. Under the EU Dual-Use Regulation, exporters are required to maintain records – in practice this means the classification basis, supporting technical documentation, any formal rulings, end-use certificates, and copies of licences or authorisation references – for a defined period after the export. The specific record-keeping window is set by the regulation and should be verified against the current text, but it is a multi-year obligation in all cases.
A classification file should contain at minimum: the item's technical specification compared against the relevant list entry; the General Technology Note and General Software Note analysis; the end-use screening result; and a conclusion with the control-list reference or a documented "not listed" determination. Where the classification is borderline, external classification advice and any correspondence with the competent authority should also be retained.
In a recent matter, a specialised chemicals manufacturer had carried out list screening at product launch but had not updated the classification when the product's performance parameters were enhanced through a formulation change. The enhanced product met a threshold it had previously missed. We assisted by scoping the exposure, preparing a voluntary self-disclosure to the competent authority, and redesigning the classification review cycle to trigger automatically on any product specification change. The matter was resolved through engagement with the authority; outcomes in voluntary self-disclosure cases vary and no specific result is guaranteed.
How does EU dual-use classification differ from the US EAR and UK regime?
Three structural divergences consistently produce risk for businesses operating across all three regimes simultaneously.
First, extraterritoriality. The EAR applies to items of US origin anywhere in the world – the de minimis rule and the foreign direct product rule mean that a European manufacturer incorporating US-origin components or producing items on US-origin production equipment may be subject to BIS jurisdiction on re-export, regardless of whether the EU Dual-Use Regulation would require a licence on the same shipment. Where the US and EU reach different conclusions on licence requirement, the stricter prohibition governs the exporter's planning. This extraterritorial dimension is often invisible to exporters who think only in terms of the country of export.
Second, control-list divergence. The EU list reflects multilateral regime commitments, as does the US Commerce Control List, but the two are not identical. Items that do not appear on the EU list may be controlled under the EAR under a US-specific parameter that has no EU counterpart, and vice versa. Classification under one regime does not transfer to the other. A dual-use review conducted solely by reference to the EU list, where the product chain includes US-origin elements, is incomplete.
Third, licensing architecture. The EU uses a system of general export authorisations at EU level (covering defined destinations and item categories) alongside Member State-specific licences. The UK, post-2021, maintains its own open general export licences through ECJU, which are similar in form but differ in destination scope and conditions. US export licences are issued by BIS and operate under different exceptions and conditions. A business managing a multi-jurisdiction export operation needs to map which authorisation covers which leg of the transaction – a single shipment may require separate clearance at each regulatory touchpoint.
Risk flags that should prompt external review
Several patterns in a classification exercise consistently indicate that specialist counsel should be involved before the goods move.
The first is a classification that has been carried forward from a predecessor product without a fresh technical comparison. In our experience, inherited classifications are one of the most frequent sources of errors identified in export-control audits. The business changes the product; the classification does not change with it.
The second is a "not listed" determination based solely on a search of the item's common name or product category, rather than a parameter-by-parameter technical comparison. The control list operates on technical specifications, not product descriptions. A software product labelled "data compression utility" may still trigger a cryptography entry.
The third is a transaction that involves a country or end-user for which the exporter has received informal guidance – from a trade association, a logistics partner, or internal memory – rather than a documented analysis. Informal guidance is not a legal defence.
The fourth is a product with both commercial and potential military or dual-use applications in a sector – communications, sensors, navigation, materials science – where the Wassenaar Arrangement or the other multilateral regimes have active control interests. These items require the closest technical scrutiny and the most thorough end-use analysis.
One common misconception in the market is that classification is purely a technical matter that can be managed within the product or engineering team without legal input. That view underestimates the legal complexity of the General Notes, the catch-all controls, and the interaction with extraterritorial rules. Classification has a technical dimension, but the legal conclusions drawn from it require a clear understanding of the regulatory regime and the enforcement environment.
Related practices
- Deemed Export and Technology Controls under the EAR – US BIS analysis for technology transfers and deemed exports
- EU dual-use classification: advanced issues – catch-all controls, technology transfers, and borderline entries
- EU dual-use licensing and authorisations – general export authorisations, specific licences, and the application process