ITAR vs EAR: Which Export Regime Applies to Your Products?

A precision instrument manufacturer in Ohio shipped accelerometer test equipment to a German partner last spring. The export compliance manager classified it under EAR, ran standard BIS screening, filed normal commercial documentation. Three weeks later, two FBI agents walked into the front office asking questions. Turns out the accelerometers had inertial guidance applications — USML Category XII territory. Wrong agency. Wrong classification. The kind of mistake that ends careers.

Key Takeaways

• ITAR (22 CFR 120-130) controls defense articles on the U.S. Munitions List; EAR (15 CFR 730-774) controls dual-use and commercial items on the Commerce Control List
• ITAR civil penalties reach $1,271,078 per violation; EAR administrative penalties cap at $374,474 per violation (January 2025 adjusted rates, Federal Register)
• ITAR licensing requires case-by-case State Department approval with zero license exceptions; EAR offers 15+ license exceptions including STA for allied destinations
• Commodity Jurisdiction (CJ) requests to DDTC take roughly 60 days and remain the only official method to resolve ambiguous classifications

What Determines Whether an Item Falls Under ITAR or EAR?

The controlling factor isn't what your product does commercially. What matters is whether it was designed, developed, modified, or configured for military or defense applications — and whether it shows up on the U.S. Munitions List (USML) maintained by the State Department's Directorate of Defense Trade Controls (DDTC).

The USML contains 21 categories ranging from Category I (firearms) through Category XXI (miscellaneous articles). Items explicitly enumerated on this list fall under ITAR jurisdiction regardless of their current commercial use. A night vision scope originally designed for military snipers doesn't magically become EAR-controlled because a hunting outfitter wants to sell it. The design intent follows the product.

September 2025 brought major USML revisions affecting 15 of 21 categories (Federal Register, 90 FR 41779). DDTC added controls on advanced aircraft components and large unmanned underwater vehicles while removing lead-free birdshot and certain GNSS anti-jam systems. Equipment you classified correctly last year? Might need another look.

If your item doesn't appear on the USML, move to the Commerce Control List (CCL). The CCL uses Export Control Classification Numbers (ECCNs) organized by category and product group. Most commercial goods that don't fit any ECCN fall into the EAR99 "basket" category — no license required for most destinations. That's where the bulk of commercial exports land.

How Do the Licensing Processes Differ?

Here's where ITAR and EAR diverge sharply in practical terms.

ITAR licensing operates through DDTC using DSP-5 applications for permanent exports and Technical Assistance Agreements (TAAs) for technical data or defense services. No standardized license exceptions exist. Every controlled export requires individual review and approval. Processing times? Anywhere from weeks to months depending on complexity, destination, and how busy DDTC happens to be that quarter.

DDTC registration is mandatory before any ITAR export activity. Annual registration fees start at $3,000 (22 CFR 122). And registration renewal sneaks up on people — it's due 30-60 days before expiration.

EAR licensing operates through Commerce's Bureau of Industry and Security (BIS) using the SNAP-R electronic system. The critical difference: EAR provides license exceptions that authorize exports without individual BIS approval when specific conditions are met. License Exception TMP covers temporary exports for trade shows. License Exception STA permits exports of many controlled items to the 36 Country Group A:5 allied nations. License Exception LVS authorizes shipments below certain dollar thresholds.

For a mid-market exporter, this distinction matters enormously. An EAR-controlled encoder shipped to a Canadian aerospace contractor might move under License Exception STA with documented prior consignee statements. Same encoder, ITAR-controlled? Full DSP-5 application regardless of destination. Canada doesn't get you a pass under ITAR.

What Happens When Classification Is Ambiguous?

Export Control Reform migrated items from the USML to the CCL over several years, creating the "600 series" ECCNs specifically for former USML items. The result: once-clear jurisdictional lines got blurry. Parts and components that were obviously ITAR years ago may now be EAR-controlled.

A thermal imaging component that was USML Category XII might now be ECCN 6A003 under EAR. But don't assume the trend continues. The September 2025 ITAR amendments signaled what industry analysts call "ITAR expansion mode" — additions now outnumber removals in recent rulemaking (Holland & Knight analysis). State Department is pulling items back onto the USML, not just releasing them.

When self-classification leaves genuine doubt, submit a Commodity Jurisdiction (CJ) request to DDTC using Form DS-4076. The interagency review — State, Commerce, sometimes DoD or NSA — typically returns a determination within 60 days. The CJ result carries official weight. It's the government's answer, not your interpretation.

What doesn't work: guessing. Assuming EAR jurisdiction without documentation exposes you to ITAR violations and creates a practical problem with customers. Defense primes and aerospace integrators routinely require CJ determinations or equivalent written classification analysis before onboarding new suppliers. Show up without paperwork and you're not getting on the approved vendor list.

How Do Penalty Structures Compare?

ITAR violations carry civil penalties up to $1,271,078 per violation or twice the transaction value, whichever is greater (22 CFR 127.10, adjusted January 2025). Criminal violations under the Arms Export Control Act reach $1 million per incident and 20 years imprisonment. RTX's $950 million settlement — announced while most of us were still processing the news — demonstrated these aren't theoretical maximums. Real money. Real consequences.

EAR violations carry administrative penalties up to $374,474 per violation or twice the transaction value (15 CFR 764.3, adjusted January 2025). Criminal penalties under ECRA reach $1 million and 20 years. Commerce Secretary Lutnick announced at the BIS Update Conference that enforcement would see "dramatic" increases. They weren't kidding — enforcement actions have accelerated noticeably since then.

The practical difference extends beyond dollar amounts. ITAR enforcement can result in debarment — complete exclusion from defense contracts and export activities. For a company whose revenue depends on defense supply chains, debarment represents an existential threat. Suddenly a $1.2 million fine looks manageable by comparison.

Both regimes allow voluntary self-disclosure (VSD). BIS formalized a "dual track" VSD process for distinguishing serious violations from minor or technical ones. DDTC similarly encourages disclosure, though without the same categorical framework. The message from both agencies: find your own problems before we find them for you.

What Practical Steps Reduce Jurisdictional Risk?

Start with a complete product inventory. Every item your company manufactures, modifies, or exports needs jurisdictional classification documented in writing. This isn't a one-time exercise — classification requires review whenever products change or regulations update. I've seen companies get burned because they classified a product line once, then spent five years adding features without revisiting the analysis.

Run the Order of Review: USML first, then CCL, then EAR99 by elimination. If USML coverage isn't clear, document your analysis. If ambiguity persists after good-faith review, consider whether a CJ request makes business sense.

For companies shipping to multiple jurisdictions with both defense and commercial customers, the decision matrix gets complicated. Some organizations maintain dual classification capability — treating the same component as ITAR-controlled for defense sales and EAR-controlled for verified commercial applications. This approach requires thorough documentation and isn't appropriate for items with any enumerated USML coverage. Get it wrong and you've created evidence of willful violation.

Technology Control Plans (TCPs) matter for both regimes when foreign nationals access controlled technical data. ITAR's deemed export provisions apply to USML technical data disclosed to non-U.S. persons even within U.S. facilities. The foreign engineer sitting in your Phoenix office? Still a deemed export problem if they're accessing controlled drawings.

FAQ

• Can the same product be subject to both ITAR and EAR simultaneously? No. An item falls under exclusive jurisdiction of one regime. However, an integrated system may contain components with different jurisdictional status — ITAR-controlled subsystems and EAR-controlled parts. The export of the complete system follows the most restrictive component's requirements.
• How long does a Commodity Jurisdiction determination remain valid? CJ determinations don't expire automatically, but regulatory changes can render them obsolete. The September 2025 USML revisions invalidated classifications that assumed prior category definitions. Companies should review CJ determinations against current regulations and request reconsideration when necessary.
• What triggers mandatory DDTC registration under ITAR? Manufacturing defense articles or furnishing defense services requires registration regardless of whether exports occur. A company that machines USML components entirely for domestic customers still must register. This catches people off guard regularly.

The jurisdictional line between ITAR and EAR determines which agency reviews your exports, what licensing mechanisms apply, and what penalty exposure exists when things go wrong. Compliance platforms — Descartes, Lenzo, SAP GTS, and others — can automate screening and documentation workflows, but the underlying classification decision remains a judgment call grounded in regulatory text. Software flags the problem. Humans still have to solve it.