A technology business with a European subsidiary sources a component in the United States, integrates it into a finished product, and begins shipping across the EU's internal market. Somewhere in that chain, a classification question is left unanswered. No one confirms whether the component carries an Export Control Classification Number (ECCN – the designation under the US Commerce Control List that determines whether a good, technology, or software requires a licence to reach a given destination). No one maps the EU's parallel dual-use regime. By the time a customs authority raises the issue, the shipments have been running for months.
ECCN classification is a US export-control mechanism, but its consequences reach directly into EU operations. An item with a US-origin ECCN may trigger re-export controls under the Export Administration Regulations – and the same item may independently require a licence under the EU dual-use regime. A business that classifies correctly for one regime but ignores the other faces exposure on both flanks simultaneously.
This case comment walks through how that exposure materialised in a representative matter, how the classification problem was identified and corrected, and what the episode means for any business moving goods or technology across the US–EU corridor.
The situation: a dual-use item moving through two regimes at once
The item at the centre of this matter was a hardware component used in secure communications equipment. The business had correctly identified it as a commercial product with no apparent military end-use. What it had not done was verify whether the component's technical parameters placed it on the US Commerce Control List – or on the EU's dual-use list (the catalogue of goods, software, and technology controlled under the EU dual-use regulation on grounds of security, nuclear non-proliferation, or chemical and biological risk).
The business operated an EU subsidiary that sourced the component from a US-incorporated supplier and incorporated it into finished units shipped to distributors in several EU member states. A third market – outside the EU – was also supplied. That third-market supply line was the one that eventually attracted scrutiny. A distributor in the third country had a beneficial owner whose name appeared, after a compliance review, on a screening database used by one of the business's banking counterparties.
The compliance question that followed was not, initially, a classification question at all. It began as a sanctions screening question. But as the review expanded – as it reliably does in our experience of cross-border matters – the classification gap surfaced. No one in the supply chain had obtained a formal ECCN determination. The component was treated internally as EAR99 (the residual classification for US-origin items not specifically listed on the Commerce Control List, which generally requires no licence for most destinations). That assumption had never been tested against the actual technical specifications.
What the EU dual-use regime requires and how it differed from the US analysis
The EU dual-use regulation establishes an autonomous list of controlled goods, software, and technology. It applies to any export from EU territory, and to brokering, transit, and intangible transfers of technology in defined circumstances. The governing authority is not a single EU body: member state authorities administer and enforce the regime nationally, though the legal basis is a directly applicable EU regulation binding across all member states.
The EU list is structured by category and entry numbers that track, broadly, the Wassenaar Arrangement's control list. That alignment with multilateral export-control regimes matters because it means that an item controlled under the Wassenaar categories will typically appear on the EU list and on the control lists of other participating states – including, in its own form, the US Commerce Control List. The regimes are architecturally similar but operationally distinct.
Three differences that regularly catch businesses out:
- An item classified as EAR99 under US rules is not automatically uncontrolled under the EU dual-use regime. The EU list uses technical parameters that sometimes capture items the US does not specifically list.
- The EU regulation imposes catch-all controls: even an unlisted item must be controlled if the exporter knows or has reason to know it may contribute to weapons of mass destruction or military end-use in defined circumstances. The US EAR has analogous catch-all provisions, but they are worded differently and trigger different procedures.
- A re-export from an EU member state of a US-origin item classified EAR99 may still require authorisation from US authorities if the destination is subject to US country-based controls. The US EAR's re-export rules bite independently of what the EU regime says about the same transaction.
In this matter, the technical review revealed that the component's encryption parameters placed it within a controlled category on the EU dual-use list. The same parameters would, under the US EAR, have placed the item in a specific ECCN – not EAR99. The EAR99 assumption was wrong on both sides of the Atlantic simultaneously.
What does that mean in practice? It means that exports of the item from the EU subsidiary to the third market required an authorisation under the EU dual-use regulation. It also means that the original supply of the component from the US supplier to the EU subsidiary likely required either a licence or the application of a licence exception under the EAR. Neither had been obtained or confirmed.
How the classification error was identified
Classification errors of this type rarely surface through proactive review. They surface through collateral scrutiny – a sanctions screening hit, a customs query, a due-diligence request from an acquirer, or a banking counterparty raising questions about a transaction. In this matter, the banking question about the beneficial owner triggered a broader compliance review. We were instructed at that point.
Our approach in matters of this kind begins with the item, not the transaction. Before any question about export authorisations can be answered, the classification question must be resolved. In this case that required:
- Obtaining and reviewing the full technical specifications of the component from the US supplier, including the encryption strength, key length, and any design-restricted deployment parameters.
- Mapping those specifications against the US Commerce Control List to determine whether the item carried a specific ECCN – or, if not, confirming EAR99 status through a commodity classification request to BIS if the position remained ambiguous.
- Running the same technical parameters through the EU dual-use list, category by category, to identify any applicable entry.
- Identifying all end-use destinations reached by each product line incorporating the component, including re-exports by distributors.
- Reviewing the US supplier's documentation to determine whether the component had been exported from the US under a licence exception that carried conditions restricting onward export or re-export.
That process confirmed the classification error and established the universe of potentially unlicensed transactions. The scope was larger than the business had anticipated, though not unusual for a supply chain that had been operating on an unverified assumption for an extended period.
What was the legal issue and which authorities were engaged?
The matter engaged two distinct legal regimes and, potentially, two sets of national enforcement authorities within the EU.
On the US side, the issue was whether the EAR's re-export controls had been triggered by the supply of the component from the US to the EU, and whether any of the onward exports from the EU constituted re-exports requiring US authorisation to the third-market destination. BIS administers export and re-export controls under the EAR. Where a potential unauthorised export or re-export is identified, the mechanism for addressing past violations is a voluntary self-disclosure (VSD – a submission to BIS reporting an apparent violation and seeking mitigated treatment). VSD practice under BIS is well established: timely, complete, and well-prepared disclosures receive the most favourable treatment, including a reduction in the base penalty. The absence of a VSD when one is warranted is itself an aggravating factor in any subsequent enforcement.
On the EU side, enforcement is a member-state function. The relevant national authority – in this case, the authority in the member state where the EU subsidiary was incorporated – was the appropriate body. EU dual-use enforcement powers, including civil and criminal penalties, are set nationally within a framework that the EU regulation defines. Voluntary disclosure mechanisms exist in some member states but are not uniform across the EU. That divergence is a material practical difference from the US regime, where a single federal authority handles all EAR enforcement.
The cross-border dimension also raised a question about which member-state authorities might have concurrent jurisdiction. Where goods transit multiple member states or where a technology transfer touches more than one jurisdiction, the question of which authority leads is not always clear. We regularly advise businesses to identify the primary authority early and to engage proactively, rather than to wait for parallel inquiries to develop independently.
The position above covers the standard analysis for an identified classification error. Your facts – the item's technical parameters, the destinations reached, the licence exceptions used or available, and the authority whose jurisdiction is most directly engaged – change the analysis significantly. For a confidential review of a potential classification issue, contact Calder & Vance at info@caldervance.com.
The route taken and the outcome
The business in this matter pursued a structured, phased response. The immediate step was to suspend outbound shipments of the affected product line pending classification confirmation. That decision, though commercially disruptive, removed the risk of continuing to accumulate apparent violations while the legal review was under way.
On the US side, counsel prepared a VSD to BIS. The disclosure was comprehensive: it covered the full scope of the apparent violations, the technical basis for the revised classification, and the remedial steps the business had taken and proposed to take. BIS's published guidance on VSD makes clear that the completeness and accuracy of the disclosure, and the quality of the corrective measures adopted, are the primary factors in determining how the matter is treated. We prepared the submission to reflect all of those factors. The matter was resolved without criminal referral, and the commercial disruption was materially shorter than it would have been had the violations been identified through a regulator-initiated inspection.
On the EU side, the national authority received a voluntary notification. The response reflected the authority's established approach: a corrective compliance programme was agreed, and the business implemented enhanced classification procedures, including a mandatory classification review at the point of product design and at each new market entry.
The third-market distributor whose beneficial owner had triggered the original screening concern was terminated as a counterparty. That decision was made on sanctions risk grounds, but it also resolved the most acute export-control exposure, because the third-market supply route was the one most directly affected by the classification error.
No guarantee of outcome is expressed here. Each matter turns on its own facts, and the result in any given case depends on the scope of the apparent violation, the authority's current enforcement posture, and the quality of the response.
Risk flags: where similar businesses go wrong
This matter illustrates several patterns that appear with regularity across classification-related enforcement situations. They are worth identifying explicitly, because each represents a decision point where a business could have intervened earlier.
Relying on a supplier's informal classification. The US supplier had indicated, informally, that the component was EAR99. That indication was not documented in writing and had not been validated by a formal commodity classification request or a written ECCN determination in the supply agreement. Informal supplier representations carry no legal weight in a BIS enforcement context. A business is responsible for its own classification determination.
Treating US and EU classification as interchangeable. The EU dual-use list and the US Commerce Control List are aligned in their architecture but differ in their technical parameters. An EAR99 determination does not translate automatically into an EU clearance. Both regimes require independent analysis.
Not mapping re-export conditions. Licence exceptions under the EAR frequently carry conditions that restrict onward supply. A business receiving US-origin goods under a licence exception needs to understand and monitor those conditions. In this matter, the exception conditions had not been reviewed against the business's actual supply chain.
Classification review limited to the point of first export. Classification is not a one-time exercise. When a product's technical specifications change, when new end-use destinations are added, or when a new end-user is identified, the classification should be re-examined. In this case, the product had been updated, but no re-classification review had been triggered by the update.
Siloed compliance functions. The sanctions screening team and the export-control team within the business operated with limited coordination. The screening hit was the event that surfaced the classification problem. A more integrated compliance structure would have identified the issue earlier. Have you reviewed whether your sanctions and export-control functions share a common trigger for escalation?
If a transaction has already been flagged, or if an apparent classification error has come to light, an early review can preserve options that narrow significantly with the passage of time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
The lesson: classification is a cross-border discipline, not a domestic one
The central lesson of this matter is structural rather than technical. The business had skilled people in its compliance team. They were not ignorant of export controls. The problem was that they had framed classification as a US question – because the US supplier was the origin point – rather than as a question that ran through every jurisdiction the supply chain touched.
Export control classification is, in substance, a series of overlapping national and multilateral determinations that attach to an item as it moves through different legal territories. The US ECCN travels with the item to the extent that re-export controls apply. The EU dual-use determination attaches at the point of export from EU territory. If the item passes through a third state with its own export-control regime – Switzerland, Japan, Singapore, or another state that maintains a national dual-use list – a further determination may be required. A commodity's classification life does not end at the first export; it extends through the full supply chain.
Practitioners working with exporters in the EU context note that the EU dual-use regulation has been progressively strengthened, with broader controls on technology transfer and more active enforcement postures in several member states. The catch-all provisions, in particular, have attracted greater regulatory attention. A business that has not reviewed its dual-use exposure recently may be operating on outdated assumptions about which items are controlled and which destinations require authorisation.
We have acted for businesses at every stage of this kind of matter: at the classification-review stage before any export is made, at the internal-investigation stage when an error is first suspected, and at the disclosure and remediation stage when the scope of the apparent violation has been established. The earlier in that sequence a business seeks advice, the wider its options remain.
A common objection we hear is that classification review is a cost that only large exporters can justify. That is a misconception. The cost of a systematic classification review for a defined product line is modest relative to the cost of a multi-jurisdiction enforcement response to an undetected error. The real question is not whether a business can afford to classify properly; it is whether it can afford to discover, after the fact, that it did not.
Related practices
- Deemed export and technology controls under BIS and the EAR – advice on technology transfer, deemed-export determinations, and US re-export conditions for EU-based businesses
- Encryption export controls: a cross-border matter – how encryption classification issues were resolved across US and EU regimes in a comparable case
- Encryption export controls and OFSI: a matter – the intersection of UK financial-sanctions and export-control obligations in an encryption context