An exporter in the technology sector wins a large order. The goods have a dual-use classification. The destination is a country where the Bureau of Industry and Security maintains heightened scrutiny. Before the shipment moves, someone needs to answer a foundational question: does an existing licence exception (a standing authorisation built into the Export Administration Regulations that permits a defined category of transactions without a separate application) already cover this transaction, or does the business need to apply for a specific licence (a case-by-case authorisation from BIS to conduct an otherwise controlled export)? Getting that call wrong in either direction costs money and creates risk. As of June 2026, the EAR's licence-exception architecture is more detailed than most exporters realise, and the gap between what is automatically available and what requires a formal application has grown as BIS has tightened controls on advanced technology items.
Under the Export Administration Regulations, administered by the Bureau of Industry and Security, exporters must first determine whether any applicable licence exception authorises the transaction; only if no exception applies – or if an exception is expressly unavailable for the relevant Export Control Classification Number (ECCN, the alphanumeric code on the Commerce Control List that determines what controls apply to an item) – should the business proceed to a specific-licence application. The distinction is not merely procedural: a mistaken reliance on an exception that does not apply is itself a violation. The analysis is item-specific, destination-specific, end-user-specific, and end-use-specific.
This briefing sets out the governing authority, the classification logic that precedes the licence decision, the exception architecture that every exporter must work through first, the specific-licence process for when no exception covers the transaction, how the UK and EU export-control regimes treat comparable situations, and the risk flags that most frequently produce enforcement referrals.
Who administers the BIS / EAR licence regime and what is its legal foundation?
The Bureau of Industry and Security, operating within the US Department of Commerce, administers the Export Administration Regulations under authority derived from the Export Control Reform Act and, as a continuing matter, the International Emergency Economic Powers Act (IEEPA). These instruments give BIS the mandate to control the export, re-export, and in-country transfer of commercial and dual-use items, technology, and software that appear on the Commerce Control List.
The EAR applies extraterritorially. A European manufacturer re-exporting US-origin items or items incorporating US-controlled technology may require a BIS authorisation even though the transaction occurs entirely outside the United States. This de minimis rule and the foreign direct product rule – both established mechanisms in the EAR for extending US jurisdiction to foreign-produced items made using US technology or equipment – create obligations that companies outside the United States frequently underestimate. In our cross-border practice, we regularly advise manufacturers and distributors in Europe, Asia, and the Gulf who discover their products carry EAR jurisdiction only after a deal is signed.
Two critical threshold questions precede any licence analysis. First: is the item subject to the EAR at all, or is it controlled by the International Traffic in Arms Regulations (ITAR), administered by the State Department's Directorate of Defense Trade Controls? Dual-jurisdiction items require careful classification before the licence question can be answered. Second: what is the item's ECCN? Items not listed on the Commerce Control List receive the designation EAR99, which generally requires no licence for most destinations – but even EAR99 items are prohibited for export to embargoed destinations or to parties on the Entity List, the Denied Persons List, or related restricted-party lists.
How does item classification shape the choice between a licence exception and a specific licence?
Classification is the gateway: the ECCN determines which reasons for control apply to an item, and those reasons for control determine which licence exceptions – if any – are available and which destinations, end-users, or end-uses trigger a licence requirement. An item classified under an ECCN that carries a National Security reason for control is subject to a different set of exceptions than an item controlled only for anti-terrorism reasons. Exporters who skip or misapply classification cannot reliably choose between exception and specific licence.
The classification process involves both the item's technical parameters and its intended function. BIS publishes classification guidance and operates a commodity-classification system through which exporters may request a formal determination. Where the classification is genuinely uncertain – for instance, because the item sits at the boundary between two ECCNs or because it incorporates newly controlled technology – obtaining a formal BIS classification before proceeding is the safer course. We have acted for technology businesses that received a commodity classification that materially changed their licence exposure and in one case resolved a long-standing compliance gap they had not known existed.
Once the ECCN is confirmed, the exporter maps the applicable reasons for control against the Country Chart, a matrix in the EAR that shows which country-reason-for-control combinations require a licence. If the item's ECCN and reason for control intersect with a requirement for the destination on the Country Chart, a licence or an applicable exception is mandatory. If there is no intersection, no licence is required – though restricted-party screening remains obligatory regardless.
What licence exceptions does the EAR provide, and when do they cover a transaction?
Licence exceptions are standing authorisations built into the EAR itself; they do not require an application to BIS and carry no individual approval. Their availability, however, is strictly conditioned: each exception carries eligibility criteria tied to the item's ECCN, the destination, the end-user, the end-use, and the value or quantity of the shipment. Misread any one criterion and the exception does not apply.
Several exceptions are frequently relevant to commercial exporters. The Technology and Software – Unrestricted exception covers certain publicly available technology and software under defined conditions. The Shipments of Limited Value exception covers low-value shipments of otherwise-controlled items to most destinations. The Shipments to Country Group B exception covers certain items destined for a defined group of lower-risk countries. The Strategic Trade Authorisation exception covers items to a defined set of trusted destinations where comprehensive export-control systems are in place, subject to item-level eligibility requirements and end-use conditions.
Each exception carries a list of items and destinations for which it is expressly unavailable. Many BIS enforcement cases arise because an exporter applied an exception without checking whether the specific ECCN was excluded from it, or because the end-user's status (appearance on a restricted-party list, involvement in a prohibited end-use such as missile proliferation) rendered the exception inapplicable. Before relying on any exception, the exporter must confirm: the item's ECCN is not excluded from that exception; the destination country is eligible; the end-user passes a restricted-party screening; and the end-use does not fall within one of the enumerated prohibited uses.
The cross-regime comparison is instructive here. The UK's Export Control Order, administered by the Export Control Joint Unit (ECJU), uses a system of Open General Export Licences (OGELs) that function similarly to EAR licence exceptions: standing authorisations available without a separate application, subject to eligibility conditions and registration requirements. The EU dual-use regime, under the applicable Council Regulation, similarly provides Union General Export Authorisations for lower-risk transactions to defined destinations. The architectures differ in scope and condition, however, and an exporter that holds an OGEL or a Union General Export Authorisation for a transaction cannot assume the equivalent EAR exception is available for the same shipment. All three regimes must be checked independently.
When is a specific licence from BIS required, and what does the application involve?
A specific-licence application to BIS is required when no licence exception covers the proposed transaction and the Country Chart analysis shows that the item's ECCN and reason for control create a licence requirement for the destination. It is also required when BIS imposes a condition on a prior authorisation that a further specific approval is needed, or when the transaction involves a party subject to an order requiring a licence for otherwise-excepted items.
The application is submitted through BIS's electronic licensing system. The required information typically includes the exporter's and consignee's details, the item's ECCN and technical parameters, the end-use and end-user, the ultimate destination, the value and quantity, and an explanation of why the transaction should be approved. BIS may request an end-use check – a pre-licence check conducted by the US Embassy or a contractor in the destination country – before making its determination. Complex or sensitive applications frequently involve interagency review, meaning the State Department and other agencies assess the application alongside BIS.
BIS does not publish binding statutory timelines for specific-licence decisions in all cases, but the process can take several weeks to several months depending on the item, destination, and end-user. Applications for items with National Security controls destined for countries of concern routinely take longer than applications for lower-sensitivity items going to allied destinations. In our experience, incomplete applications – missing technical data, vague end-use descriptions, or unexplained gaps in the supply chain – are the single largest source of delay. An application that anticipates the agency's questions shortens the review materially.
A specific licence, once issued, carries conditions: permitted end-users and end-uses, quantity limits, an expiry date, and record-keeping obligations. BIS may revoke a licence if it finds the factual basis for the grant was incorrect or if conditions change. The licence is not a permanent authorisation, and exporters must screen against the denied-parties lists at the time of each shipment under the licence, not just at the time of application.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, and the restrictions in play – change the analysis. For an assessment of your specific licensing position under the EAR, contact Calder & Vance at info@caldervance.com.
How do the UK and EU licensing regimes compare with the BIS / EAR specific-licence process?
The UK's specific-licence equivalent is the Standard Individual Export Licence, issued by ECJU. The SIEL covers a defined item, quantity, consignee, and end-use. ECJU's published processing target for SIEL applications is a matter of weeks for straightforward cases, though applications involving items with military or dual-use sensitivity and complex end-users can take considerably longer. A registration requirement applies to many OGELs, and reliance on an OGEL without completing registration is a violation of the Export Control Order.
The EU process varies by member state: authorisations are issued by national competent authorities rather than a central EU body, though the substantive grounds for assessment are set by the applicable Council Regulation. A business exporting dual-use items from Germany, France, or the Netherlands applies to that member state's authority under common Union criteria. The divergence in processing times and administrative practice across member states is a practical issue for companies operating across multiple EU jurisdictions.
For businesses whose transactions engage two or more regimes simultaneously – for example, a UK subsidiary of a US parent exporting items that contain US-controlled technology to an end-user that also triggers EU dual-use licensing – the applicable country regime's requirements must each be met independently. There is no mutual recognition between the EAR, the UK export-control regime, and the EU regime. The stricter prohibition governs: if one regime requires a specific licence, the transaction cannot proceed under a general authorisation available only in another regime. We regularly advise cross-border businesses on mapping all applicable licence requirements before a transaction proceeds, precisely because an approval in one jurisdiction does not carry over.
What are the most common risk flags in the licence-choice decision?
Reliance on an exception that the ECCN or destination renders unavailable is the single most common error in EAR export-control practice. It arises most frequently when exporters apply a checklist from a previous transaction without re-checking the current version of the EAR or without confirming that the item's classification has not changed following a periodic review of the Commerce Control List.
End-user risk is the second major area. A transaction that would otherwise qualify for a licence exception may become subject to a licence requirement if the end-user appears on a BIS restricted-party list, if there are red flags of diversion to a prohibited end-use, or if the end-user is in a country subject to a heightened-scrutiny designation. The red-flag indicators published by BIS – requests for unusual packaging, reluctance to identify the ultimate end-user, payment terms inconsistent with standard commercial practice – are not exhaustive but provide a working framework. Ignoring them is inconsistent with the EAR's know-your-customer obligation.
Technology and software transmissions are frequently overlooked. The EAR controls not only the physical export of items but also the transmission of controlled technology by email, cloud access, or verbal disclosure to a foreign national in the United States (a deemed export). A company that ships hardware correctly but transmits the accompanying controlled software or technical data without considering the EAR has violated the controls even if the hardware shipment was fully licensed. This is an area where the EAR diverges most sharply from many exporters' intuitive understanding of what "export" means.
Record-keeping failures compound underlying compliance errors. BIS requires exporters to maintain records of all export transactions for a defined period. Where an enforcement review commences, the absence of contemporaneous records – classification decisions, exception eligibility analyses, restricted-party screening records, end-use certificates – removes the ability to demonstrate that a good-faith analysis was performed. A voluntary self-disclosure (VSD, the process by which an exporter self-reports a potential violation to BIS in exchange for mitigation credit) is far more credible when supported by documentation showing the analysis that was performed and where it broke down.
If a transaction has already been flagged, or if an internal audit has surfaced a potential violation, an early review preserves options that narrow with time. For a confidential review of a potential breach or a VSD assessment, contact Calder & Vance at info@caldervance.com.
A common misconception: "EAR99 items never need a licence"
A persistent myth in export-compliance practice is that EAR99 items – those not listed on the Commerce Control List – are always freely exportable without a licence or any further analysis. This is incorrect, and reliance on it has produced significant enforcement outcomes.
EAR99 items require a licence when the destination is subject to a comprehensive US trade embargo under an applicable country regime, when the end-user appears on the Entity List, the Denied Persons List, or the Unverified List, or when the exporter has reason to know that the item will be used in a prohibited end-use such as the development of weapons of mass destruction. The country-level embargoes administered by OFAC – distinct from, but often overlapping with, BIS controls – apply to EAR99 items without exception. A business that screens its items and finds them EAR99 has completed one step, not the analysis.
The myth also affects technology businesses that supply software as a service or through cloud platforms. Even if the underlying software would be EAR99 in a physical export, access granted to a foreign national in an embargoed country is a controlled transaction under the EAR. The medium of delivery does not change the legal position. In our practice, we have seen this misconception arise repeatedly at companies whose compliance programmes were designed around physical goods and not updated when the business moved to software-led delivery models.
Related practices
- BIS / EAR Frozen Account and Asset Management – managing frozen property and restricted account obligations under the EAR licensing regime.
- BIS / EAR Licence Analysis: Further Considerations – extended analysis of BIS licence conditions, conditions of use, and post-approval obligations.
- Specific vs. General Licences Under OFSI – how the UK OFSI licensing architecture compares with the BIS / EAR approach for cross-border transactions.