ITAR vs. EAR: Which Export Control Regime Applies to You

Every defense contractor asks a version of the same question eventually: is this part, this drawing, this piece of software ITAR, or is it EAR? The question sounds simple. The answer determines which federal agency you register with, what license, if any, you need before you ship the item or even discuss it with a foreign national, and how exposed you are if you get it wrong. Two different regulations, two different agencies, two different lists of controlled items, and one company caught in the middle trying to figure out which rulebook it's actually playing by.

Manufacturers in sectors ranging from commercial aviation components to ruggedized electronics have assumed that a civilian application meant EAR automatically applied. Others — particularly in the defense supply chain — have assumed ITAR covered anything remotely defense-adjacent, registering and licensing items that were never on the U.S. Munitions List to begin with. Both mistakes cost money. Only one of them, ITAR misclassification in the direction of under-control, can cost you a referral to the Department of Justice.

This guide walks through what each regulation actually controls, how the two interact, and how to figure out which one governs your product before you ship anything.

What ITAR Actually Controls

The International Traffic in Arms Regulations, 22 CFR Parts 120 through 130, implement the Arms Export Control Act, 22 U.S.C. § 2751 et seq., and are administered by the State Department's Directorate of Defense Trade Controls, DDTC. ITAR governs defense articles, defense services, and related technical data: items specifically designed, developed, configured, adapted, or modified for a military application, and listed on the United States Munitions List.

The USML, codified at 22 CFR 121.1, organizes controlled items into 21 categories, Category I (firearms) through Category XXI (miscellaneous articles), covering everything from tanks and military aircraft to gas turbine engines, protective personnel equipment, and the technical data needed to design or produce any of it. If your item, or a component of it, appears on the USML, you're in ITAR's world, full stop, regardless of where the item ends up being sold or how it's marketed commercially.

Any U.S. person who manufactures a defense article must register with DDTC under 22 CFR 122.1, even without ever exporting anything. Registration is not a license. It's a prerequisite, renewed annually, and it applies whether or not you've shipped a single part overseas.

What EAR Actually Controls

The Export Administration Regulations, 15 CFR Parts 730 through 774, are administered by the Commerce Department's Bureau of Industry and Security, BIS, under authority consolidated in the Export Control Reform Act of 2018, 50 U.S.C. §§ 4801-4852, effective August 13, 2018. EAR covers dual-use items, things with both commercial and military or proliferation-sensitive applications, along with purely commercial items and the less sensitive military items that were moved off the USML during the Export Control Reform initiative of 2013-2016.

Controlled items appear on the Commerce Control List, organized into 10 categories and 5 product groups, and identified by a five-character Export Control Classification Number, an ECCN, such as 3A001 or 9E515. Not everything subject to the EAR has an ECCN. Items subject to the EAR but not matching a specific CCL entry are designated EAR99, a catch-all classification that still requires screening for embargoed destinations, denied parties, and prohibited end uses, even though it rarely requires an individual export license.

The Difference in One Sentence

Here's the cleanest way I've found to explain it to a client in one sitting: ITAR asks whether the item was built for war, EAR asks who might get their hands on it and what they'd do with it. ITAR jurisdiction is rigid: if an item is a defense article, it stays under State Department control regardless of buyer or use. EAR is contextual: the same physical item can move freely to some destinations and require a license to others, depending on end user, end use, and country of ultimate destination.

ITAR vs. EAR at a Glance

How to Determine Which One Applies to Your Item

Classification starts with the USML, not the CCL. That ordering matters. If your item is described on the U.S. Munitions List, or was specially designed for a defense article listed there, a test defined at 22 CFR 120.41, it's ITAR-controlled even if the exact same part also has an obvious civilian use. A bearing that happens to fit inside both a commercial generator and a military radar system is only EAR-controlled if it clears the specially designed test. If it doesn't, it's ITAR, and the fact that a hardware store sells the identical part changes nothing.

If you genuinely can't tell, and I mean after checking the USML categories and the specially designed definition, not before, you can request a Commodity Jurisdiction determination from DDTC under 22 CFR 120.4. A CJ request puts the classification question in the government's hands rather than yours, which is exactly where you want it sitting when the answer is close. Guessing wrong in the direction of "it's probably just EAR" is the most common way small manufacturers end up on the wrong side of a State Department inquiry.

Once you've ruled out ITAR, the EAR self-classification process asks a different question: does the item match a specific ECCN entry on the CCL, based on its technical parameters? BIS publishes the CCL with enough technical detail that most companies can self-classify, and BIS will also issue a formal classification, a CCATS, on request if you want the government's answer in writing.

Why the De Minimis Rule Matters

One of the sharpest practical differences between the two regimes is what happens when a foreign-made product contains U.S.-origin content. Under the EAR's de minimis rule, 15 CFR 734.4, a foreign-made item incorporating controlled U.S. content generally escapes EAR jurisdiction on reexport if that U.S. content falls below 25 percent of the item's value, or below 10 percent for reexports to countries subject to a U.S. arms embargo. ITAR has no equivalent threshold. If a foreign-made item incorporates ITAR-controlled U.S. content or technical data, in any amount, it typically remains subject to ITAR under what practitioners call the see-through rule. A single ITAR-controlled component buried inside an otherwise foreign-built system can pull the whole assembly under State Department jurisdiction. This is the fact that catches foreign subsidiaries and supply chain partners off guard more than almost anything else in export control.

Can One Product Trigger Both?

Not simultaneously for the identical item: jurisdiction is exclusive at any given moment, but products migrate. The Export Control Reform initiative moved thousands of less sensitive military items off the USML and onto the CCL's "600 series" ECCNs between 2013 and 2016, and that migration is still a live source of confusion for companies whose product lines predate it. If your compliance documentation still treats a part as ITAR because that's what it was a decade ago, it's worth rechecking. I've seen companies over-comply for years, running full ITAR registration and licensing on parts that migrated to EAR jurisdiction back in 2014, simply because nobody revisited the classification after the reform took effect.

It's also common for a single program to involve both regimes at once: the airframe is ITAR, the avionics software might be EAR, and the commercial fasteners are neither. Classification happens at the item level, not the program level or the company level. Treating an entire contract as "ITAR" because one line item is a defense article is the over-correction version of the same mistake.

Registration and Licensing in Practice

DDTC registration under ITAR is mandatory for manufacturers of defense articles regardless of export volume, renewed annually, and it's a precondition to applying for any export license or exemption. Registration itself doesn't authorize a single export; it gets you into the system so DDTC can process license applications tied to your registration.

EAR has no equivalent blanket registration. Licensing is transactional: BIS evaluates a specific export based on the ECCN, the destination country's entry on the Commerce Country Chart, the end user, and the stated end use. Many EAR99 and lower-sensitivity ECCN exports proceed under a license exception with no individual application at all. That's a meaningful operational difference for a small manufacturer budgeting compliance overhead: ITAR imposes fixed annual costs before you ship anything, while EAR's costs are more variable and transaction-driven.

Deemed Exports Apply Under Both

Neither regulation requires an item to cross a border to trigger a violation. Releasing technical data or controlled technology to a foreign national on U.S. soil, in a design review, a plant tour, or an email attachment, counts as an export to that person's home country under both ITAR and EAR. Companies that carefully control physical shipments while leaving foreign national employees or visiting engineers with unrestricted access to a shared drive are exposed under either regime. It's the same failure mode wearing two different regulatory hats.

Penalties: Converging, Not Identical

Since ECRA's 2018 codification, the criminal penalty ceilings under ITAR and EAR have converged: both carry a statutory maximum of $1,000,000 per willful violation and up to 20 years imprisonment for an individual. Civil penalty amounts under both regimes are adjusted periodically and published in each agency's regulations; any specific dollar figure cited here may not reflect the most current adjustment. Check current figures before relying on a number you read somewhere else, including this article; our violations and penalties page tracks the mechanics and current enforcement trends in more depth. What hasn't converged is enforcement posture. DDTC's consent agreements tend to bundle remedial compliance program requirements and external audits alongside the fine, in a way BIS settlements don't always mirror.

A Practical Classification Workflow

For a company that's never formally classified its product line, the sequence that holds up under scrutiny is:

1. Pull the technical description and specifications for the item.
2. Check it against the USML categories and the specially designed definition at 22 CFR 120.41; document the rationale in writing regardless of which way the conclusion comes out.
3. File a CJ request with DDTC under 22 CFR 120.4 if the USML analysis is genuinely ambiguous.
4. Rule out ITAR before touching the CCL. Only after a documented USML determination should you move to step 5.
5. Self-classify against the CCL or request a CCATS from BIS once ITAR is ruled out.
6. Revisit the classification whenever the item's design, its end use, or the regulations themselves change. That last step is the one companies skip. Export Control Reform proved that the list itself moves. A classification from 2015 is not a permanent fact about your product, it's a snapshot that needs a recheck cycle built into your compliance program.

Common Misconceptions Worth Correcting

A dual-use application does not mean automatic EAR jurisdiction. The specially designed test governs, not the existence of a civilian market for the part. A small company with no export sales is not exempt from ITAR registration if it manufactures a listed defense article domestically; registration attaches to manufacturing, not exporting. And software and technical data are covered every bit as thoroughly as hardware under both regimes. A drawing, a source repository, or a test report can be the controlled item even when nothing physical ever leaves the building.

Frequently Asked Questions

What is the main difference between ITAR and EAR? ITAR, 22 CFR Parts 120-130, covers defense articles and services listed on the U.S. Munitions List and is administered by the State Department's DDTC. EAR, 15 CFR Parts 730-774, covers dual-use and less sensitive military items on the Commerce Control List, administered by the Commerce Department's BIS. ITAR jurisdiction is based on what the item is; EAR licensing is based on where it's going and to whom.

Can the same product be regulated by both ITAR and EAR? Not the identical item at the identical moment, jurisdiction is exclusive, but a single program often includes both: one component ITAR-controlled, another EAR-controlled, and some parts subject to neither. Products can also migrate between the two lists, as thousands did during the 2013-2016 Export Control Reform initiative.

How do I find out if my product is on the USML or the CCL? Start with the U.S. Munitions List at 22 CFR 121.1 and the specially designed definition at 22 CFR 120.41. If the analysis is unclear, file a Commodity Jurisdiction request with DDTC under 22 CFR 120.4. Only after ruling out ITAR should you self-classify against the Commerce Control List or request a CCATS from BIS.

Does the de minimis rule apply to ITAR-controlled items? No. The EAR's de minimis rule, 15 CFR 734.4, excuses foreign-made items with less than 25 percent U.S.-controlled content, or 10 percent for arms-embargoed destinations, from EAR jurisdiction on reexport. ITAR has no equivalent threshold: any amount of ITAR-controlled U.S. content or technical data in a foreign-made item generally keeps the whole item under ITAR.

What happens if I misclassify an export as EAR when it should have been ITAR? You've exported a defense article without a State Department license, a violation of the Arms Export Control Act regardless of intent. Penalties can include civil fines and, for willful violations, criminal penalties up to $1,000,000 and 20 years imprisonment per violation under 22 U.S.C. § 2778(c). Filing a voluntary disclosure with DDTC generally mitigates the outcome; discovery by the government during an audit or investigation does not.

Classification isn't a paperwork exercise you knock out once and file away. It's the decision that determines every other compliance obligation your company carries, from registration to recordkeeping to who's allowed to see the drawings. Get it wrong in the direction of too little control, and the exposure isn't administrative. It's criminal.

Last updated: 2026-09-14