Goods-origin verification under EU: step by step

A freight forwarder receives a purchase order for a batch of industrial lasers. The goods are commercially available, sold to dozens of customers globally, and have never triggered a query. Yet a colleague flags that the end-destination sits outside the EU's core trading partners. The question that follows is precise and urgent: how do you verify the origin of these goods under the EU regime before the shipment leaves?

Goods-origin verification under the EU export-control regime is the process of establishing whether an item is of EU origin, re-exported from an EU member state, or otherwise subject to EU jurisdiction, and then determining what controls – if any – apply before it moves across a border. The governing instrument is the EU Dual-Use Regulation, which applies to items on the EU Common List of controlled goods as well as to items not on the list where a catch-all clause may be triggered. As of January 2026, the recast regime under the applicable EU dual-use rules remains in force, and enforcement by national competent authorities is active across multiple member states.

This guide walks a representative export transaction through the verification process from first receipt of the order to final shipment clearance, identifying the decision points, the risk flags, and the moments when specialist counsel should be involved.

Stage one: establish jurisdiction – does EU law apply to this shipment?

The first question in any goods-origin verification exercise is whether the EU dual-use rules apply at all. EU controls attach to items that are exported from, brokered within, or transited through the EU, regardless of the nationality of the exporter. A non-EU company routing a shipment through a member state port or re-exporting goods that were first imported into the EU can be within scope. The territorial trigger is broader than many businesses assume.

Jurisdiction is not solely a question of where the goods are manufactured. If an item was produced outside the EU but enters EU customs territory and is subsequently re-exported, the EU regime applies to that re-export leg. This is a point that catches importers who treat their incoming shipments as purely domestic and only consult their compliance team at the outbound stage.

In our experience, businesses operating multi-leg supply chains – importing into a member state warehouse, then shipping onward to non-EU customers – frequently underestimate the point at which EU controls engage. The practical test is: at any leg of the movement, is the item physically in EU customs territory or being handled by an EU-established entity? If yes, EU dual-use rules are in play.

There is also a deemed-export dimension to consider. Releasing controlled technology to a foreign person within EU territory – through training, technical assistance, or remote access – can constitute an export of that technology. The verification process should therefore look at information flows and technical services, not only physical shipments.

Stage two: classify the item against the EU Common List

Once jurisdiction is confirmed, the next stage is classification – determining whether the item appears on the EU Common List, and if so, under which entry. The EU Common List is structured by category, and each entry specifies the technical parameters that bring an item within control. Classification is a technical exercise that requires the actual specifications of the goods, not just a commercial description.

A commercial description in a purchase order is almost never sufficient for classification purposes. The relevant parameters – processing speed, wavelength, tensile strength, software capability – must be matched against the control list parameters. Where the specifications are borderline, the correct approach is to obtain a formal classification opinion from the national competent authority, which in most EU member states is the licensing directorate of the relevant ministry.

Two risk points arise at this stage. First, the classification must be current. Items move on and off control lists as the underlying technology changes, and a classification performed two years ago may not reflect the present position. Second, the catch-all clause: even an item that does not appear on the EU Common List may require a licence if the exporter has grounds to suspect it will be used for weapons of mass destruction, military end-uses in an embargoed destination, or other specified purposes. The catch-all is not a residual risk that can be ignored once a negative classification result is reached.

This is where the myth that commercial availability removes control risk is most dangerous. An item sold by thousands of manufacturers worldwide and marketed for industrial use can still be controlled if its technical parameters meet a list entry, or if the end-use raises a catch-all concern. We regularly advise clients who have operated on the assumption that because a product is listed in a consumer catalogue it cannot be a controlled item. That assumption has led to licence violations in multiple enforcement cases across the EU.

Stage three: screen the destination, end-user, and end-use

Classification determines what is being exported. Destination, end-user, and end-use screening determines to whom and for what. These three elements are assessed together, and a controlled item destined for a restricted destination or end-user requires a licence regardless of how routine the commercial relationship appears.

Destination screening means checking the receiving country against EU arms embargoes, the UN Consolidated List, and any applicable autonomous EU sanctions regime. Certain destinations trigger a presumption of denial under EU rules, and for others a licence is required even for items that would otherwise be freely exportable. The applicable regime for each destination is not static: designations and embargoes change, and a shipment that was permissible last quarter may require a licence today.

End-user screening is the more granular exercise. It means verifying the identity and beneficial ownership of the actual recipient, not merely the immediate purchaser. Where the purchaser is a trading company or an intermediary, the verification chain must extend to the final consignee and – if there is any doubt – to the end-user of the technology. The EU ownership test for sanctions purposes looks at whether a person owns more than 50 percent of the entity or otherwise controls it, and a counterparty that is majority-owned by a listed entity is itself caught by an asset-freeze even if it does not appear on the list by name.

End-use screening asks the practical question: what will this item actually do in the recipient's hands? An end-user statement is a standard documentary requirement for many EU licences, but it is not a self-certifying document. Where the stated end-use is implausible given the buyer's business model, or where the item has obvious dual-use potential that the buyer has not addressed, the exporter cannot rely on the statement as a complete control. A sharp divergence between the stated commercial use and the technical capability of the item is a red flag that warrants escalation.

How does the EU approach differ from other regimes?

A cross-border exporter cannot treat EU goods-origin verification as an isolated exercise. Many shipments that pass through or originate in EU member states also involve US-origin technology or are destined for markets where the US, UK, or other regimes independently impose controls. Understanding where the EU approach converges with, and diverges from, those regimes is essential to building a verification process that does not inadvertently satisfy one regime while breaching another.

The most significant divergence is between the EU and US positions on jurisdiction over re-exports and foreign-produced items. US extraterritorial reach – through the Foreign Direct Product rules under the EAR – can bring an item within US jurisdiction even where it contains only a de minimis proportion of US-origin controlled content or is produced using US-origin controlled technology. The EU dual-use rules do not operate on the same extraterritorial basis. An item that is not of EU origin and does not transit EU customs territory is generally not subject to EU export controls, even if it incorporates some EU-origin components. A business selling non-EU goods may face no EU licensing requirement but a significant US licensing obligation for the same transaction.

The UK position, post-Brexit, is substantively aligned with the pre-Brexit EU control list but administered separately by the ECJU under the Export Control Order. UK licences do not substitute for EU licences, and a business exporting from both an EU member state and a UK entity must hold appropriate authorisations from both competent authorities. The control parameters are closely harmonised but not identical, and divergences have emerged at the margin since the UK began updating its control list independently.

The principle that where two regimes apply the stricter prohibition governs is the practical rule for multi-regime transactions. In our cross-border practice, we see exporters who correctly manage the EU classification and licensing step but underestimate their concurrent US obligations because the goods are assembled in Europe. The fact that a finished product is manufactured in an EU member state does not eliminate US jurisdiction over the technology used to produce it.

Where a shipment involves advanced computing components, the interaction between EU dual-use controls and US advanced computing rules is particularly complex, and the two regimes are updated on different timelines. Exporters managing this intersection should treat the classification exercise as parallel, not sequential.

Stage four: select the correct authorisation and apply

Once classification and screening are complete, the authorisation stage begins. EU export controls operate through four main authorisation types: national export authorisations (specific licences), EU general export authorisations (EUGEAs), national general export authorisations (NGEAs), and global licences for regular exporters with established compliance programmes. The correct type depends on the item, the destination, and the exporter's status.

EU general export authorisations cover defined categories of low-risk items to approved destinations and are self-executing – an exporter who meets the conditions may ship without a separate application. They are not, however, a blanket clearance. The exporter must still verify that the item, the destination, and the end-use fall within the precise scope of the authorisation. A mis-reading of an authorisation's scope is itself a compliance failure, even where the underlying transaction would have been licensable on application.

Specific licences are required for items and destinations outside the scope of available general authorisations, and for transactions where the catch-all clause has been triggered. The application is made to the national competent authority of the member state from which the goods are to be exported. Timelines for specific licences vary by member state, by the complexity of the item, and by the current caseload of the authority. They can range from a matter of weeks to several months for complex cases, and exporters who assume that a licence application filed close to a shipping deadline will be processed in time regularly miss their commercial windows.

Global licences are available in some member states for established exporters who maintain a verified internal compliance programme. They reduce the per-transaction administrative burden significantly, but they come with enhanced record-keeping obligations and the risk that a compliance failure causes the global licence to be suspended. The investment in obtaining a global licence is therefore only justified where the exporter has sufficient transaction volume and a compliance programme of corresponding depth.

Risk flags and when to involve counsel

Certain patterns in a transaction are red flags that should prompt an escalation to compliance counsel before the shipment proceeds. These are not hypothetical: they are the fact patterns that appear repeatedly in EU enforcement actions and in the referrals we receive.

Diversion risk is the most common. A consignee whose stated business does not match the technical capability of the item, a destination in a low-risk country that is adjacent to a higher-risk market, or an order volume that significantly exceeds what the stated end-user could plausibly consume – each of these warrants a closer look. A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion red flag under EU anti-circumvention guidance, and transit does not change an item's controlled status. The item follows its origin and its end-use, not its route.

Payment and logistics anomalies matter too. Cash-in-advance for high-value technical goods from a new customer, requests to alter shipping documents, and changes to the consignee name after the order is confirmed are each, individually, grounds to pause the transaction. They are also the patterns that enforcement authorities use as evidence of knowledge in criminal proceedings.

Counsel should be involved where: the classification is borderline or the competent authority's view is needed; the end-user's ownership chain involves entities in restricted destinations; the catch-all clause may apply; a previously issued licence is about to expire and the goods have not shipped; or the exporter has identified a potential past compliance failure. In the last case, early involvement is critical. National competent authorities across the EU take voluntary disclosure into account, but the window for disclosure to provide meaningful mitigation is short, and what is disclosed – and how it is framed – materially affects the outcome.

The position under the applicable EU dual-use rules is that enforcement is a national competence: each member state's competent authority investigates and sanctions violations within its territory. Penalties vary by member state, but an EU directive on the criminalisation of sanctions violations has set minimum standards, including maximum imprisonment terms of at least five years for serious offences, and fines calculated as a percentage of worldwide turnover. As currently in force, verify before reliance. The practical implication is that a violation by a subsidiary in one member state can result in criminal exposure in that jurisdiction, alongside licence denial consequences that affect operations across the EU.

Building a repeatable goods-origin verification process

A single-transaction verification is not a compliance programme. Businesses that approach EU goods-origin verification as a one-off exercise for each shipment carry higher residual risk than those that embed the process in their commercial operations. What does a repeatable process look like?

First, classification should be maintained as a living document. A product's controlled status should be re-verified whenever its specifications change, when the EU Common List is updated, or when the item is proposed for export to a new destination category. Classification decisions should be recorded with the technical basis and the date, so that they can be audited and updated.

Second, destination and end-user screening should be integrated into the order-intake process, not deferred to the shipping stage. A compliance hold at order intake is a commercial inconvenience. A compliance hold at the loading dock, after a letter of credit has been drawn and a vessel has been booked, is a serious operational problem. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, and in our experience the most costly errors occur when screening is treated as a logistics step rather than a sales step.

Third, record-keeping must be systematic. EU dual-use rules require exporters to retain documentation relating to export transactions for a defined period. Those records must be sufficient to reconstruct the classification basis, the licence relied upon, the end-user verification steps taken, and the shipping outcome. An exporter who cannot produce that documentation on request from the competent authority is in a poor position to demonstrate due diligence.

Fourth, the compliance programme should be tested against actual transaction patterns, not against an abstract checklist. A goods-origin verification compliance checklist that is calibrated to the business's real product range, real customer base, and real shipping routes will surface gaps that a generic checklist will miss. Periodic internal review – and, for exporters with significant volume, periodic external review by specialist counsel – is the mechanism by which that calibration is maintained.

Finally, training. The person who receives and processes the purchase order, the logistics coordinator who prepares the shipping documents, and the finance team processing the payment all need to know what a red flag looks like and to whom they report it. A compliance programme that lives in a policy document and a legal team's email inbox is not a functioning control.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.