Does encryption in my product trigger export controls?

Often yes, and it is a separate question from whatever else the product does. There are workable exceptions, and each has conditions you must actually meet.

Written for: Software and hardware teams shipping anything with cryptography

Why encryption gets its own treatment

Cryptography has its own entries on the Commerce Control List and its own licence exception. The analysis is independent of what the product is for. A perfectly ordinary commercial device can pick up a control simply because of how it protects data, and TLS, disk encryption, a signed firmware update, or an encrypted radio link all count as using cryptography.

The exceptions that make it workable

License Exception ENC covers a great deal of commercial encryption, and mass market treatment covers much of what is sold widely through retail channels. Publicly available encryption source code has its own treatment again. None of these is automatic. Each carries eligibility conditions, and some carry a notification or reporting requirement that people forget because the exception felt like an exemption.

The mistake that costs the most

Assuming the exception applies and never writing down why. When someone later asks which exception you relied on, on which date, against which version of the rule, the answer needs to exist. That record is cheap to make at the time and impossible to reconstruct two years later.

The adjacent question

If you are asking about encryption because you want to hold engineering data in the cloud or take it abroad, that is a different rule with different conditions. Encryption can keep a transmission from being treated as an export, but only when every condition is met, including that nobody else holds the keys.

The rules behind this

• 15 CFR 740.17
• 15 CFR 742.15
• 15 CFR 772.1
• 15 CFR 774

This is a plain reading of published rules, not legal advice, and it is not a determination about your item. What decides your case is your exact configuration, your parties, and your destination. The limits, in full.

Next

• License Exception ENC
• What does EAR99 actually mean?
• Find out what applies to you

Related questions