Export Controls & Compliance-as-Code
ITAR vs. EAR: What Founders and Engineers Actually Need to Know
A practical comparison of the International Traffic in Arms Regulations and the Export Administration Regulations -- how to determine which applies, what triggers each, and what to do about it
Atomic answer
The International Traffic in Arms Regulations (ITAR) govern defense articles and services listed on the US Munitions List, while the Export Administration Regulations (EAR) cover dual-use items on the Commerce Control List and all other exports. Determining which regime applies to your product starts with a jurisdiction classification -- checking whether the item is specifically designed for military use or listed on the USML.
Who is this for?
This article is for founders, CTOs, and technical leads building hardware, software, or systems with potential defense or dual-use applications. If you are developing drones, sensors, communications systems, encryption software, satellite technology, robotics, or advanced materials -- and you have not confirmed whether your product falls under ITAR or EAR -- this guide is your starting point. It is also relevant for investors conducting due diligence on defense and deep-tech portfolio companies. This is informational, not legal advice. Consult a trade attorney for your specific classification.How do you know if ITAR applies to your product?
ITAR applies to items that are specifically designed, developed, configured, adapted, or modified for a military application and are listed on the United States Munitions List (USML) at 22 CFR Part 121. The USML covers 21 categories including firearms, ammunition, explosives, military vehicles, spacecraft, military electronics, and -- critically -- technical data and defense services related to these items.\n\nThe key question is not whether your current customers are military. The question is whether the item falls into a USML category based on its design intent and technical characteristics. A drone that is capable of carrying a payload of 500 kg or more and has a range exceeding 300 km may fall under USML Category VIII regardless of whether it is currently sold to commercial agriculture customers — thresholds defined in the USML itself. The 'specially designed' test — whether the item has properties that uniquely enable it to perform a military function — is the central classification criteria.\n\nITAR also covers defense services. If your company provides assistance to foreign persons — including training, technical support, or integration services — related to a USML item, that assistance is a defense service subject to ITAR. Most founders focus on the product classification and miss the services layer, which is how many early-stage companies first trigger ITAR compliance obligations.\n\nRegistration with the Directorate of Defense Trade Controls (DDTC) is required for any company that engages in ITAR-controlled manufacturing, exporting, or brokering. The annual registration fee is $2,250 for new applicants (DDTC Tier 1, as of 2024; verify current fee schedule at pmddtc.state.gov). The registration process typically takes 4 to 6 weeks from submission to approval. Operating without registration when ITAR applies is a violation even if no export has occurred.When does EAR govern instead?
The EAR governs everything that ITAR does not. This includes dual-use items -- those with both commercial and military applications -- listed on the Commerce Control List (CCL), as well as items not listed on any control list. An item that does not appear on the USML or the CCL is classified as EAR99 and is generally free of licensing requirements except for exports to sanctioned countries or prohibited end users.\n\nThe Commerce Control List spans hundreds of distinct ECCN entries across 10 broad categories: nuclear materials, chemicals, electronics, computers, telecommunications, sensors, navigation, avionics, marine systems, and propulsion (see 15 CFR Part 774, Supplement No. 1 for the complete CCL). Each ECCN specifies the control reason (national security, chemical and biological weapons, missile technology, regional stability, crime control, anti-terrorism, etc.) and the licensing requirements for each destination.\n\nThe practical distinction for most founders: ITAR controls are broader and more restrictive. ITAR requires registration, imposes more extensive recordkeeping, restricts foreign national access to technical data more severely, and has no de minimis rule (even a tiny ITAR-controlled component in a larger system subjects that system to ITAR). EAR controls are more granular and include exceptions, de minimis rules, and tiered treatment based on destination country.\n\nCommodity jurisdiction (CJ) determinations are the formal mechanism for resolving whether an item falls under ITAR or EAR. A CJ request is submitted to DDTC, which determines USML jurisdiction. If DDTC finds the item is not USML-controlled, it is referred to BIS for CCL classification. The CJ process typically takes 2 to 4 months, though complex cases can extend longer. Self-classification is permitted but must be documented with a rationale.What is the jurisdiction classification flowchart?
The classification decision tree proceeds through four questions in sequence. First: Is the item specifically designed, developed, configured, or modified for military application and does it appear on the USML? If yes, jurisdiction is ITAR. If no, proceed to the second question.\n\nSecond: Is the item specifically designed, developed, configured, or modified for a space application and listed on USML Category XV? Spacecraft and related items have their own USML category. Certain commercial space items have been moved to EAR control in recent amendments. If yes, jurisdiction is ITAR (unless a specific exception applies). If no, proceed to the third question.\n\nThird: Does the item appear on the Commerce Control List under any ECCN? If yes, jurisdiction is EAR, subject to the ECCN-specific licensing requirements. If no, proceed to the fourth question.\n\nFourth: The item is classified as EAR99. No license is required for export to most destinations, but the item still cannot be exported to sanctioned countries, Entity List parties, or prohibited end users.\n\nThe most common mistake founders make is skipping the first question. They assume that because their product has commercial applications, it cannot be ITAR-controlled. But the USML covers items by technical specification and design intent, not by customer base. A sensor that achieves sub-meter resolution or above a certain frame rate is USML-controlled if it exceeds the ITAR threshold, even if it is cheaper and smaller than military-grade sensors — consult the specific USML category for the applicable technical parameters.What are the most common startup scenarios that get this wrong?
First scenario: the commercial drone startup. A company builds small uncrewed aircraft systems for agricultural surveying. The aircraft has a range of 50 km and a payload capacity of 5 kg. The startup discovers during investor due diligence that their flight controller firmware is classified as 'specially designed' for a military UAV under USML Category VIII — even though they only sold to farmers. The remedy: commodity jurisdiction determination and potential redesign to remove specially designed characteristics.\n\nSecond scenario: the encryption software startup. A company develops a secure messaging protocol using encryption that exceeds 512 bits. Under ITAR Category XI, encryption items that exceed certain parameters are controlled. The startup's foreign-national engineers access the codebase during development, triggering a deemed export that the company had not considered. The remedy: jurisdiction determination and, if ITAR-controlled, a deemed export licensing strategy for foreign national employees.\n\nThird scenario: the SATCOM hardware startup. A company builds low-cost satellite communications terminals for commercial maritime connectivity. The terminal operates at frequencies and power levels that trigger either ITAR Category XV or CCL Category 5A001.a. The startup has not classified the item and has accepted international orders. The remedy: immediate jurisdiction assessment and potential voluntary disclosure to BIS or DDTC.\n\nThe common thread: none of these startups intended to develop controlled items. They built technology that happens to meet a technical threshold defined in the control lists, and the compliance obligation triggered at design — not at first export.Stack & State is an editorial and ecosystem-intelligence publication. Nothing here is legal, investment, procurement, or compliance advice. Program details change; verify requirements with primary sources and qualified advisors.