Export controls and compliance-as-code

The Complete Guide to Export Controls for Deep-Tech Startups

Updated July 8, 2026

A builder-readable map of ITAR, EAR, CFIUS, product architecture, and fundraising risk.

When Does Export-Control Exposure Actually Begin? From Incorporation to Your First International Customer

The moment a founder should start thinking about export controls is not at the Series B legal review. It's the moment you put code on GitHub - where the public availability exception can collide with controlled export - or the moment you hire a foreign national, triggering the deemed export rule. It's when you deploy inference in a non-US cloud region, when your encryption library crosses the ITAR threshold, or when your customer is a foreign government. The trigger points in a startup lifecycle:

Incorporation: Jurisdiction choice (Delaware C-corp vs. foreign parent) sets the control baseline. A startup with a foreign parent or foreign subsidiary faces additional restrictions under EAR § 734.2(b).

First hire: Hiring a non-US person triggers deemed export obligations. Releasing controlled technology to a foreign national inside the United States is an export to that person's country of citizenship. EAR § 734.13(b) defines deemed exports; ITAR § 120.17 does the same for defense articles.

First repo: Pushing source to a public GitHub repo may qualify for the public availability exception under EAR § 734.3(b) - but not if the technology is ITAR-controlled or subject to restricted encryption controls under ECCN 5D002.

First deployment: Deploying software or model inference to a non-US cloud region can constitute an export of controlled technology. AWS, GCP, and Azure all offer US-region-only deployment options precisely because cloud routing decisions are export decisions.

First international customer: Selling to a foreign government or state-owned enterprise may trigger end-use and end-user controls under EAR Part 744. The customer's identity matters as much as the product's classification.

First fundraise: Foreign investment, especially from state-backed funds or entities with ties to countries of concern, can trigger CFIUS review. A 2025 Treasury outbound investment proposed rule further complicates fundraising from certain foreign LPs.

In FY 2023, BIS received 36,582 export license applications, processing roughly 85% favorably but averaging 36 days for standard cases - a timeline that can kill a startup's sales cycle if not anticipated. (Source: BIS Annual Report to Congress, FY 2023)

How Should Founders Map Product Architecture to Regulatory Risk? ITAR, EAR, ECCN, and the ‘Specially Designed’ Trap

The two primary US export-control regimes operate on different classification systems - and a single product can fall under both.

ITAR (International Traffic in Arms Regulations) governs the US Munitions List (USML), 22 CFR § 121.1. Items on the USML are defense articles and services: weapons, munitions, military electronics, spacecraft, and their specially designed parts. ITAR-controlled items require a license or exemption for any export - the standard is strict. ITAR registration with DDTC is required for manufacturers and exporters of defense articles.

EAR (Export Administration Regulations) governs the Commerce Control List (CCL), 15 CFR Part 774, Supplement No. 1. The CCL covers dual-use items - commercial products with potential military applications. Items are classified under Export Control Classification Numbers (ECCNs), organized across 10 categories (0–9) and 5 product groups (A–E).

How to determine your ECCN: Start with the CCL category that best fits your product's function, then work through the subparagraphs. If no ECCN fits, your item may be EAR99 - subject to EAR but requiring a license only for sanctioned destinations, end-users, or end-uses. You can self-classify or request a CCATS (Commodity Classification Automated Tracking System) determination from BIS.

The “specially designed” trap: A component that is “specially designed” for a defense article can inherit ITAR control even if it looks like a standard commercial part. The test under ITAR § 120.41: was it developed with defense articles as one of its primary functions? If yes, it may require State Department licensing - even when all your customers are commercial.

When AI model weights become controlled: Under EAR, certain AI models trained on restricted technical data or designed for military end-uses may have their weights classified as controlled technology. The October 2022 BIS interim final rule on advanced computing and semiconductor manufacturing (87 FR 62186) established controls on certain AI-related items; subsequent rules have expanded scope to include model weights exceeding specified training-compute thresholds.

Architecture decisions that shape regulatory posture:

• On-device inference keeps data local, reducing export exposure from cross-border cloud data flows.
• Cloud inference in US regions only (AWS us-east-1, us-west-2, etc.) limits deemed export risk from foreign access to model weights.
• Open-weight vs. proprietary: Open-weight releases may qualify for the public availability exception - but only if the release is genuinely uncontrolled and the underlying technology is not ITAR-restricted.
• US-region deployment as a minimum: Global deployment requires jurisdiction-by-jurisdiction analysis of end-user and end-use controls.
• Encryption libraries: Must be classified under ITAR USML Category XI vs. EAR ECCN 5A002/5D002. The encryption registration requirement under EAR § 742.15(b) applies even to publicly available software.

Real examples (anonymized): A drone startup discovered their flight controller firmware fell under USML Category VIII because it was “specially designed” for a military-grade UAV - even though they sold to commercial agriculture. An AI startup training models on satellite imagery learned that their training pipeline triggered deemed export rules because foreign-national engineers accessed controlled technical data during training runs.

The Commerce Control List spans over 1,200 distinct ECCN classifications. Civil penalties for misclassification reach $300,000+ per violation under the Export Control Reform Act of 2018. (Source: 15 CFR Part 774, Supp. No. 1; 50 U.S.C. § 4819)

Where Do ITAR, EAR, CFIUS, and the Entity List Collide? The Compliance Stack for a Single Transaction

ITAR, EAR, CFIUS, and Entity List constraints are not separate compliance silos. A single transaction can hit all four simultaneously - and founders who treat them as independent workstreams create gaps that diligence or enforcement will exploit.

The collision scenario: A deep-tech startup accepts a $15M Series A from a sovereign wealth fund (CFIUS jurisdiction), selling a product containing controlled electronics (an EAR ECCN) to a foreign government customer (end-use restriction under Part 744) whose procurement entity appears on the Entity List (BIS screening hit). The product also incorporates defense-spec encryption (ITAR USML Category XI). One deal, four regulatory regimes.

How they interact:

• ITAR controls the product: USML classification (22 CFR § 121.1) determines whether the State Department's DDTC must license the export. ITAR licenses are jurisdictional, not transactional - they cover a defined scope of activity for a defined period.
• EAR controls the components: CCL classification (15 CFR Part 774) governs whether BIS must license the components, software, or technology. Unlike ITAR, many EAR items can be exported under license exceptions (e.g., ENC for encryption, TMP for temporary exports).
• CFIUS reviews the foreign investor: The Committee on Foreign Investment in the United States reviews transactions that could result in foreign control of a US business. Mandatory filings apply for certain critical technology transactions. CFIUS can impose mitigation agreements, block transactions, or - in the worst case - recommend the President unwind a closed deal.
• Entity List blocks the customer: BIS's Entity List (Supplement No. 4 to Part 744) identifies foreign parties for whom a license is required for all items subject to EAR. Screening against this list - and the broader Consolidated Screening List - is mandatory before any export. No license exception can override an Entity List requirement.

The compliance stack for technical founders:

1. Classification: Determine your product's ITAR/EAR classification (USML category, ECCN, or EAR99). Document the rationale in an internal memo - this is your primary record if BIS or DDTC audits. Use a CCATS request for uncertain classifications; a self-classification is defensible only if well-documented.
2. Licensing: Map each export scenario (product shipment, cloud deployment, employee access, investor diligence data room) to the required license or exemption. BIS SNAP-R for EAR licenses; DDTC DECCS for ITAR licenses. Build a matrix: scenario × jurisdiction × classification = license requirement.
3. Screening: Screen every customer, investor, employee, and contractor against the Consolidated Screening List: Entity List, Denied Persons List, Unverified List, SDN List, and Debarred Parties List. Automate this - manual screening does not scale past 10 customers.
4. Recordkeeping: Maintain export records for 5 years under EAR § 762.6 and ITAR § 122.5. Records include classification determinations, license applications, screening results, shipment records, and employee nationality documentation.

Compliance-as-code tools and patterns:

• Automated classification: Tools that scan product BOMs and flag items matching CCL/USML descriptions against a maintained taxonomy.
• CI/CD screening gates: Automated license and sanctions screening checks integrated into deployment pipelines, blocking releases to non-approved regions or customer accounts.
• Infrastructure-as-code for region controls: Terraform/CloudFormation policies that enforce US-region-only deployment and prevent data egress to non-US regions via SCPs or Azure Policy.
• License management APIs: Platforms that track license status, expiration, commodity jurisdiction determinations, and proviso conditions across product lines.
• Audit trail automation: Automated logging of all export-relevant events - code pushes, deployments, employee access grants, investor data room invitations - for the 5-year recordkeeping requirement.

CFIUS reviewed 342 transactions in 2023; 56% were mandatory filings in critical technology sectors - the highest rate since FIRRMA expanded the committee's authority in 2018. (Source: CFIUS Annual Report to Congress, CY 2023)

Stack & State is an editorial and ecosystem-intelligence publication. Nothing here is legal, investment, procurement, or compliance advice. Program details change; verify requirements with primary sources and qualified advisors.

Verified sources

• BIS Annual Report to Congress, FY 2023
• CFIUS Annual Report to Congress, CY 2023
• Commerce Control List, 15 CFR Part 774, Supp. No. 1
• Export Control Reform Act of 2018, 50 U.S.C. § 4819

Last verified 2026-07-08