Foreign direct product rules under BIS / EAR: a compliance guide

A manufacturer based in Europe designs a circuit board using US-origin software tools. The finished board is produced entirely outside the United States, shipped between two non-US parties, and never touches US soil. Does the Export Administration Regulations (EAR, the US Commerce Department's export-control rules administered by the Bureau of Industry and Security, BIS) apply to that transaction? As of January 2026, the answer is very often yes. The foreign direct product rules (FDP rules) are the legal mechanism that extends US export-control jurisdiction to items manufactured abroad when they are the direct product of controlled US technology, software, or equipment. Missing that trigger is one of the most common – and most expensive – compliance failures we see in cross-border export-control matters.

The FDP rules bring foreign-produced items within the scope of the EAR when those items are the direct product of US-origin technology or software that is subject to the EAR and controlled for national-security reasons, or when they are produced by a plant or major component of a plant that is itself such a product. Liability is strict: the rules operate without regard to whether the non-US manufacturer knew it was using controlled US inputs. Determining whether the FDP rules apply requires a structured, two-part analysis – first, the product test; second, the destination or end-user test.

This guide walks through that analysis step by step, identifies the branch points where the compliance answer changes, maps the interaction with other regimes, and flags the situations where specialist export-control counsel should be involved early.

What triggers the FDP rules in the first place?

The threshold question is whether the item at issue is the direct product of technology or software that is both subject to the EAR and controlled for national-security reasons on the Commerce Control List (CCL, the BIS classification schedule listing controlled items by their Export Control Classification Number, ECCN). If the answer is yes, the item produced overseas is itself subject to the EAR – even though it was made entirely outside the United States.

Two distinct pathways bring an item within scope. The first is the product pathway: the foreign item is directly produced using controlled US technology or software. A chip designed using US electronic-design-automation software that is controlled under an ECCN for national-security reasons is the paradigm case. The second is the plant pathway: the item is manufactured in a facility, or by a major component of a facility, that is itself the direct product of controlled US technology or equipment. A fabrication line built with US semiconductor-manufacturing equipment controlled on the CCL brings every item it produces into the analysis.

The word "direct" does not mean "immediate." BIS has made clear that the rules extend to products at more than one remove from the original US-origin input, provided the causal link is present. In our practice, the plant pathway is consistently under-estimated: companies focus on the software licence used in design and overlook the provenance of the production machinery itself.

What if the US-origin technology is open-source or publicly available? Technology that qualifies as publicly available under the EAR – published in the public domain without access or use restrictions – is generally excluded from EAR controls entirely. That exclusion, however, has defined conditions, and commercially licensed software that happens to be widely used does not automatically qualify. The distinction matters enormously: an incorrect assumption of public availability will not constitute a defence in a BIS enforcement proceeding.

If the product test is met: how does the destination or end-user test work?

Meeting the product test alone does not always make a transaction subject to EAR controls: many applications of the FDP rules also require that the item is destined for a specified destination, end user, or end use. This is the second branch of the analysis, and it is where the rules have become considerably more granular since 2019.

BIS has developed a series of named FDP rules, each with its own destination and end-user criteria. The original national-security FDP rule captures items destined for certain Country Group D:1 destinations. Later rules – notably those directed at specific entities identified on the Entity List (the BIS list of parties subject to licence requirements) – work differently. For an Entity-List-specific FDP rule, the product test is still required, but the key question is whether the item is destined for, or will be incorporated into or used in the production of an item for, a listed entity. There is no destination-country filter in that structure: the listed entity's location is irrelevant once it appears on the list.

This distinction is practically critical. A shipment of foreign-produced chips destined for an unlisted buyer in a non-controlled country might fall entirely outside the FDP rules. The same chips routed to a listed entity – or incorporated into a product for that entity – trigger the licence requirement regardless of geography. Have you screened not just the direct buyer but the end user and the product's ultimate destination in the supply chain?

The foreign direct product rules applicable to advanced computing and semiconductor manufacturing equipment introduced in 2022 and amended subsequently operate on a similar structure but with broader destination and product-type criteria. As of January 2026, those rules continue to evolve. Verify the current scope of any named FDP rule against the operative text before transacting, particularly where the goods involve advanced chips or the equipment used to produce them.

How do you map your supply chain to the BIS / EAR analysis?

The practical compliance task is a supply-chain trace: working backwards from the finished foreign product to identify every point at which US-origin technology, software, or equipment entered the production process. This is not a one-time exercise. It must be repeated each time the product specification changes, each time a manufacturing partner is added or substituted, and each time BIS amends the relevant controls.

A workable methodology follows four steps. First, identify and classify the US-origin technology and software used in design. Each tool or technology needs to be assessed against the CCL: is it classified under an ECCN controlled for national-security reasons, or is it EAR99? An EAR99 input does not trigger the FDP rules. Second, identify and classify any US-origin equipment used in production. The plant pathway requires the same ECCN analysis for manufacturing equipment as the product pathway does for design tools.

Third, once a controlled input is identified, determine which FDP rule – if any – applies to the resulting product. Different rules set different scope conditions. The national-security rule and the entity-specific rules have different architectures. Applying the wrong rule to the facts is a common error. Fourth, if an FDP rule applies, assess whether a licence exception covers the transaction or whether a specific licence from BIS is required. Licence exceptions under the EAR are available for specified transactions but eligibility is item-, end-use-, and destination-specific; they cannot be assumed.

In our experience, step three is where manufacturers who handle steps one and two well still make errors. The structure of the named FDP rules is not identical, and counsel advising on BIS matters regularly encounters compliance programmes that conflate them.

What if your product sits in another country's supply chain? The cross-regime dimension

The FDP rules are a unilateral extension of US jurisdiction, and they operate independently of – and sometimes alongside – the export-control rules of the jurisdiction in which the foreign manufacturer operates. A Taiwan-based manufacturer is subject to the EAR when the FDP rules apply, and also subject to the export-control rules of the applicable national regime. Those regimes do not necessarily reach the same conclusion about whether a licence is required, which controls apply, or which end users are restricted.

The EU dual-use regulation (the recast EU rule on controls for dual-use items, as currently in force) controls exports from the EU but does not generally extend to items produced entirely outside the EU – even items made with EU-origin technology. The FDP rules occupy a different legal space: they travel with the US-origin inputs, not with the place of production. A non-US company that believes its product is "outside" US jurisdiction because it was made in Europe should examine whether any US-origin design tool or equipment was in the production chain. That examination frequently surfaces a US nexus that was not visible at first.

The UK export-control regime, administered by the ECJU under the Export Control Order, operates on a territorial and goods-based basis and does not contain an equivalent FDP mechanism. However, where a UK manufacturer exports an item that is also subject to the EAR by reason of the FDP rules, both regimes apply simultaneously. The stricter prohibition governs: a transaction cannot proceed where either regime requires a licence that has not been obtained.

For businesses operating between the EU or UK and destinations subject to US controls, the cross-regime interaction creates a matrix that must be mapped transaction by transaction. We regularly advise manufacturers who have correctly navigated the EU or UK rules only to discover late in a transaction that an FDP analysis was also required and had not been performed.

What are the key risk flags that should prompt an urgent review?

Several patterns consistently signal that an FDP analysis is either missing or likely to be wrong. Identifying them early limits the exposure. A mis-classified item exposing the company to penalties is the most common consequence when these signals are ignored.

The first flag is a supply chain that includes US semiconductor-manufacturing equipment or US electronic-design-automation software, combined with a customer or end user that has recently appeared on, or is a close affiliate of a party on, the BIS Entity List. Even where the direct buyer is not listed, the end-use question must be asked.

A sharp change in demand from a distributor in a jurisdiction that neighbours a destination subject to broad US controls is a recognised diversion red flag. Transit through a third country does not change an item's controlled status: the FDP analysis follows the item and its US-origin inputs, not the routing. A business that has concluded "we export to Country X, not to Country Y" has not necessarily resolved the FDP question if the item may be incorporated into a product destined for Y.

The third flag is a product redesign. When a manufacturer substitutes a different tool, equipment set, or foundry, the prior FDP analysis no longer applies without review. The new production pathway must be traced from the beginning. We have acted on matters where a manufacturing-cost optimisation – a foundry switch – inadvertently introduced a US-origin equipment nexus that had not existed before, bringing a product line within the FDP rules for the first time.

Finally, the myth that commercial-off-the-shelf items cannot be controlled requires direct correction. The EAR controls items by their technical parameters and end use, not by their commercial availability. A chip that is widely sold does not become EAR99 because of its market position. Where a commercially available item meets the technical criteria of a controlled ECCN – and is produced using inputs that trigger the FDP rules – it is controlled, regardless of how ordinary its commercial profile looks.

When should you involve export-control counsel – and what should that engagement look like?

The question of when to call counsel is itself a decision point in the compliance programme. Earlier is almost always better, and the cost of an early classification and FDP review is a fraction of the cost of a voluntary self-disclosure, a BIS denial order, or a loss of export privileges.

Counsel should be involved at the product-development stage when a design team intends to use US-origin EDA software or foundry equipment to produce an item that may be destined for controlled destinations or end users. Waiting until a specific transaction arises means the classification and FDP analysis are compressed into a commercial timeline that does not leave adequate time for a careful review.

For businesses that already transact in products that may be within scope, the engagement typically begins with a classification review: confirming the ECCN (or EAR99 status) of the US-origin inputs and applying the relevant FDP rule to the product. That review produces a determination – either the item is not subject to the EAR under the FDP rules, or it is, and in that case the transaction-by-transaction analysis begins.

Where a potential violation is identified – a shipment that may have gone forward without the required licence – the analysis shifts to whether a voluntary self-disclosure (VSD, a self-initiated report of a potential violation to BIS) is appropriate. VSD is a recognised mitigating factor under BIS enforcement practice, as it is under OFAC's Enforcement Guidelines. The decision to file a VSD involves a legal analysis of the apparent violation, the likely enforcement posture, and the disclosure obligation: it is not a mechanical step and should not be taken without counsel.

Our practice covers the full range of BIS/EAR matters: classification reviews, FDP analyses, licence applications, end-use controls, and enforcement defence. We work with manufacturers, distributors, technology companies, and financial institutions that finance controlled-goods transactions. For a confidential review of a potential FDP exposure or to stress-test your screening and compliance programme, contact Calder & Vance at info@caldervance.com.

For matters involving advanced computing and semiconductor controls – where the FDP rules are at their most complex – see our dedicated service: Advanced computing controls under BIS / EAR. For guidance on verifying the origin of goods under the EAR, see our goods origin verification guide (BIS / EAR), and for the parallel EU analysis, our goods origin verification guide (EU).

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.