ECCN Determination: 9 Key Technical Specs

BIS receives roughly 34,000 classification requests annually (Bureau of Industry and Security, FY2024). Forty-one percent come back marked incomplete. That number hasn't budged in three years.

The problem isn't complicated. Exporters submit product descriptions. "High-performance industrial controller." "Enterprise-grade network switch." "Precision measurement device." BIS sends it back. Every time.

The Commerce Control List doesn't care what marketing calls your product. It cares about nine technical parameters—and whether those parameters cross specific thresholds.

Key Takeaways

• Commerce Control List contains 2,700+ ECCNs across 10 categories (15 CFR Part 774, Supplement 1). Most exporters only encounter 30-40 regularly.
• Nine technical parameters drive controlled-item classifications. Processing speed, encryption strength, accuracy, wavelength, bandwidth, detection capability, material composition, operating temp, pressure rating. Miss one, your request comes back.
• 41% of BIS classification requests returned incomplete in FY2024 (BIS Annual Report). The number was 39% in FY2023.
• Self-classification errors cost US exporters ~$2.1B annually in delays and license processing (Census Bureau trade flow analysis, 2024)

The Threshold Problem Nobody Talks About

Here's what trips up even experienced compliance teams: the CCL operates on threshold logic. An item gets controlled when its technical parameters exceed defined limits. Not because of function. Because of performance.

Category 4 example. Server with 48 weighted teraflops processing capability? Ships EAR99. Same exact architecture at 64 weighted teraflops? Triggers 4A003.b. Requires destination review for most countries outside Group A:1.

The product does the same thing. The regulatory treatment is completely different.

I watched a $14M shipment sit in a warehouse for six weeks in 2023 because engineering provided "approximately 60 WTFLOPS" on the classification form. Approximately. BIS wanted the actual APP calculation—precision weighting, measurement conditions, the whole worksheet. Nobody had run the numbers properly.

The 9 Parameters That Actually Matter

Nine specs drive the bulk of controlled-item determinations. Miss any of these and your classification request joins the 41%.

• Processing capability tops the list for Category 4. The Adjusted Peak Performance formula in 15 CFR 772 converts raw computing power into weighted teraflops. Marketing claims 500 teraflops peak? The APP might yield 35 weighted teraflops once you account for precision and architecture. I've run these calculations dozens of times. The delta between marketing numbers and APP results surprises engineering teams every single time. That GPU cluster your sales team is hyping could be EAR99 or 4A003.b depending entirely on how BIS runs the math.
• Encryption implementation matters more than key length alone. Category 5 Part 2 distinguishes between 256-bit symmetric and 256-bit asymmetric—same bit count, different treatment. License Exception ENC (15 CFR 740.17) carves out mass-market encryption, but only when encryption serves a subsidiary function. A router with 256-bit AES for management traffic? Different classification than a dedicated encryption appliance using identical algorithms. I've seen companies get burned on this distinction repeatedly.
• Accuracy and resolution drive Categories 6 and 7. Position sensor accurate to 100 meters? Ships freely. Sub-meter accuracy? You're in 7A003 territory. Infrared systems compound this—minimum resolvable temperature difference combined with spatial resolution. Missing either spec guarantees a returned request.
• Wavelength and frequency range catch people off guard. Laser at 850nm versus 1550nm? Different controls. Identical power output. Microwave components hit escalation points at 2.7 GHz, 6.8 GHz, 31.8 GHz, 37.5 GHz. The March 2024 CCL amendments moved several wavelength thresholds for fiber optic components. If your classification matrix predates that update, you're working with bad data.
• Bandwidth controls apply to network equipment regardless of underlying technology. Base station at 1 Gbps aggregate throughput versus 10 Gbps? Different treatment. The tech stack is irrelevant.
• Detection sensitivity creates problems because marketing specs cite "typical" performance. BIS wants minimum detectable levels. Chemical detection under 1A004? Parts-per-billion thresholds. Your datasheet says "typically detects at 5 ppb"—but what's the minimum detectable concentration under specified test conditions? That's the number that matters.
• Material composition gets granular fast. Categories 1 and 2 control items by chemical makeup, not product category. Carbon fiber? Controls depend on modulus and tensile strength. Titanium alloys? Specific elemental percentages determine treatment. The 2025 amendments tightened rare earth controls—caught a lot of companies off guard. Seen multiple shipments held because exporters submitted decade-old MSDS documents instead of current composition certificates. The chemistry hasn't changed. The regulatory thresholds have.
• Operating temperature catches commercial-off-the-shelf products marketed to aerospace customers. Electronics rated -55°C to +125°C face different classification than commercial-grade at 0°C to +70°C. Identical products. Different temperature specs on the datasheet. Different export controls.
• Pressure ratings round out the list. Pumps, valves, vessels rated above specific thresholds enter controlled territory. Application is irrelevant. A vacuum pump at 10^-8 Torr versus 10^-3 Torr? The mechanism might be identical. The export treatment isn't.

Why Self-Classification Keeps Failing

Three documentation gaps drive most errors.

Gap one: marketing specs instead of tested parameters. A datasheet claiming "high precision" gives BIS nothing to work with. They need numbers. Test methods. Measurement conditions. "High precision" isn't a threshold—it's a sales pitch.

Gap two: typical versus maximum capability. Export controls trigger on what an item *can* do. Not what it usually does. Not what customers typically need. A sensor that occasionally achieves controlled-level accuracy under optimal lab conditions? Controlled. Doesn't matter if field performance never hits that mark.

Gap three: embedded components. This one kills people.

That industrial controller? Contains a processor with calculable APP. That network switch? Includes encryption functionality. That measurement device? Has a sensor with quantifiable detection limits.

I know an aerospace supplier shipping assemblies with 47 distinct items requiring individual classification. Their process takes three weeks per new product introduction. And they *still* catch embedded component oversights during annual audits. Three weeks of engineering time per SKU, and mistakes slip through.

What BIS Actually Wants on Form 748P

Commodity classification requests require specific technical data formats. Not marketing collateral. Not product brochures.

Processing equipment: the APP calculation worksheet. Raw capability, precision weighting, final weighted teraflops. Test methodology and measurement conditions included.

Encryption items: algorithm, key length, implementation mode, functional integration within the system. Distinguish between encryption, authentication, and key management functions.

Sensors: minimum detectable signal under specified test conditions. Resolution parameters. Wavelength or frequency response curves. Environmental operating specifications.

Materials: complete chemical composition with percentage ranges. Mechanical property test results. Manufacturing specifications.

The common failure? Submitting a product datasheet and expecting BIS to extract relevant parameters. Classification engineers process thousands of requests annually. They're not going to reverse-engineer your marketing materials to find the controlled specs buried in footnote 3 on page 47.

FAQ

What if my product exceeds one controlled parameter but not others?

Single parameter triggers ECCN assignment. Computer with controlled processing capability falls under 4A003 even when every other spec stays below threshold. The CCL uses "or" logic within ECCNs. Any controlled attribute captures the item.

How often do CCL thresholds change?

More often than most compliance teams track. Federal Register notices publish amendments 3-4 times annually for substantive changes. October 2024 semiconductor controls. March 2025 quantum computing amendments. Monitor the Federal Register directly—don't wait for the annual CCL consolidation. By the time that publishes, you've been shipping under outdated classifications for months.

Can I use manufacturer specifications for classification?

Only if they document tested parameters against recognized measurement standards. Marketing materials citing "typical" or "approximate" values? Insufficient. Request technical datasheets with test methodology references and measurement tolerances. If the manufacturer can't provide those, your classification has a documentation problem. Platforms like Lenzo, Descartes, and SAP GTS can help connect ECCN classifications to downstream licensing requirements, but the underlying technical documentation remains your responsibility.