Learning Center

Export compliance, in plain English.

What U.S. export compliance is, why it applies to physical goods and digital ones, what happens if you skip it, and the seven-step order of review every exporter needs to follow. No prior compliance background required — if you ship anything internationally, this page is the shortest path from “I don’t know what I don’t know” to a working mental model.

Get started — free Use in Claude / Cowork (plugin)

Why this is the law

Three regulatory regimes, one decision tree.

U.S. export compliance is governed by three overlapping regimes. Most SMB manufacturers only ever touch the EAR, but a single defense-related part can pull you into ITAR, and a single buyer in the wrong place can pull you into OFAC. Knowing which regime applies is step one of the order of review.

Regime 01 — EAR

Export Administration Regulations.

The big one for commercial and dual-use items. Administered by the Bureau of Industry and Security (BIS). Covers anything from a headlight housing to industrial pumps to encrypted firmware. Most SMB manufacturers live entirely under the EAR.

Authority15 CFR Parts 730–774 · BIS (Department of Commerce)

Regime 02 — ITAR

International Traffic in Arms Regulations.

The smaller, stricter regime for defense articles, defense services, and related technical data. Administered by the Directorate of Defense Trade Controls (DDTC). If you make anything on the United States Munitions List, you live here — and you must register before you ship anything.

Authority22 CFR Parts 120–130 · DDTC (Department of State)

Regime 03 — Sanctions

OFAC sanctions and embargo programs.

Administered by the Office of Foreign Assets Control (OFAC). Country-level (Cuba, Iran, North Korea, Syria, Russia carve-outs) and party-level (Specially Designated Nationals). You can be EAR-clean and still hit an OFAC wall on the buyer or destination.

Authority31 CFR Parts 500–599 · OFAC (Department of Treasury)

What counts as an “export”

It’s not just stuff in a box.

The single most common SMB misconception is that export controls only cover physical goods. The EAR is explicit: software, technology, technical data, and even verbal releases of know-how to a foreign person count as exports. Four categories you need to know, with the citation that locks each one in.

Physical goods

Anything you can put in a box.

Parts, sub-assemblies, finished products, raw materials, prototypes, test equipment. The EAR controls items by their technical characteristics, not their physical form.

Citation15 CFR § 734.3 — Items subject to the EAR

Software

Yes, software counts.

Object code and source code are both controlled. Encryption-bearing software (5D992) has its own classification path under License Exception ENC. Even free public-domain code can be controlled depending on the algorithm.

Citation15 CFR § 734.3(a)(2) and 15 CFR § 740.17 (License Exception ENC)

Technology / technical data

The blueprints, the specs, the know-how.

Technical data necessary to develop, produce, or use a controlled item is itself controlled. CAD files, technical drawings, manufacturing process documentation — all of it. Even a verbal disclosure to a foreign engineer can qualify as a controlled export.

Citation15 CFR § 734.3(a)(3) and § 734.7 (Published)

Deemed exports

Releasing tech inside the U.S. counts as exporting it.

If you give a foreign national access to controlled technology or source code on U.S. soil — a hire, a contractor, a tour group — that release is treated as if you exported it to their country of citizenship. This catches a lot of SMBs by surprise.

Citation15 CFR § 734.2(b)(2)(ii) and § 734.13(a)(2)

What happens if you skip it

BIS enforcement is at unprecedented levels.

FY2025: $192M in criminal and administrative penalties plus $81M in forfeitures, both records. Enforcement is shifting downmarket — the Fortune 500 already has compliance teams. SMBs don’t. The cheapest answer used to be “hope nothing goes wrong.” That answer just got expensive.

Civil penalty (per violation)

Up to $374,474

EAR civil cap, January 2025 inflation adjustment. ITAR cap is higher (~$1.4M).

Criminal penalty (per violation)

$1M and/or 20 years

Per ECRA 2018, applied via 15 CFR Part 766 (EAR) and 22 CFR Part 127 (ITAR).

Loss of export privileges

Years

Denial Order under 15 CFR § 766.25 — can shut down an exporter entirely.

Real recent example

$252M

Applied Materials, 2025 — the largest single BIS settlement on record.

The order of review

Seven steps, in this order, every time.

Compliance professionals call this “the order of review” for a reason — you can’t skip a step or do them out of order. Step 1 (jurisdiction) determines whether you’re even reading the right rulebook. Step 7 (recordkeeping) is what keeps you defensible five years from now when a BIS auditor asks. ExChek runs all seven for you with citations on every output.

Jurisdiction.

Decide which regime applies — EAR or ITAR — before anything else. Defense article? ITAR. Commercial / dual-use? EAR. Get this wrong and the rest is wrong.

Citation15 CFR § 734.3 (EAR scope) and 22 CFR § 120.5 (ITAR jurisdiction)

Classification.

Find the specific entry that controls your item. Under EAR, that's an ECCN on the Commerce Control List. Under ITAR, it's a USML category. The classification dictates everything that follows.

Citation15 CFR Part 774 (CCL) and 22 CFR Part 121 (USML)

Denied-party screening.

Run every party in the transaction — buyer, end-user, intermediate consignee, freight forwarder — against the U.S. government's published lists. The fastest way to do this is through the Consolidated Screening List (CSL), which combines BIS Entity List, OFAC SDN, DDTC Debarred, and others. If you get a hit, you stop.

Citation15 CFR Part 744 (Entity-based controls) and the Consolidated Screening List at trade.gov

Country and end-use review.

Look up the destination on the Commerce Country Chart for your specific reasons-for-control. Then check end-use restrictions: military end-use, military end-user, missile, nuclear, chemical / biological, surveillance. The same item ships freely to Germany and is license-required to a long list of other countries.

Citation15 CFR Part 738 (Country Chart), Part 742 (Reasons for Control), Part 744 (End-use)

License determination.

Given the classification, the destination, and the end-use, determine whether you need a license — and whether any License Exception applies (ENC, GBS, LVS, TMP, RPL, etc.). If a license is required, you stop and apply through SNAP-R (BIS) or DECCS (DDTC). You do not ship until the license is in hand.

Citation15 CFR Part 740 (License Exceptions) and Part 748 (Application procedures)

Export Compliance Program (ECP).

A documented program covering training, screening procedures, classification methodology, recordkeeping, audit cadence, and red-flag escalation. Not technically mandatory under the EAR, but BIS treats the presence (or absence) of a documented ECP as a major mitigating-or-aggravating factor in any enforcement action.

CitationBIS Export Compliance Guidelines (published at bis.gov) and DDTC Compliance Program guidance

Recordkeeping and retention.

Keep every classification, screening, license determination, shipment record, and supporting document for at least five years from the date of the export (or longer if a license, agreement, or audit triggers a longer hold). Records must be accessible, complete, and tamper-evident.

Citation15 CFR Part 762 (EAR retention) and 22 CFR § 122.5 (ITAR retention)

How ExChek fits

Every step above maps to a skill.

The plugin ships with skills covering every step of the order of review. You don’t need to memorize the CFR sections — you need to know they exist, and you need a tool that does the lookup correctly every time.

Jurisdiction & Classification — the jurisdiction and classify skills walk through 15 CFR § 734.3 / 22 CFR § 120.5 then land on the right ECCN or USML category.
Denied-party screening — the csl skill hits the Trade.gov Consolidated Screening List API and adjudicates hits.
Country and end-use — the country-risk and red-flag-assessment skills run the Country Chart and the BIS Supp. 3 checklist.
License determination — the license skill walks Part 740 exceptions and produces a cited memo.
Export Compliance Program — the ecp skill drafts an SOP package tailored to your footprint.
Recordkeeping — the recordkeeping skill produces a 15 CFR Part 762-aligned retention schedule and writes every classification to a sealed audit log.