Export controls: ITAR, EAR, SCOMET

1. The core idea#

Export controls are rules on sending certain goods, software and technology across borders, or to certain people, because they could help weapons programmes, militaries or hostile states. Software founders rarely meet them. Deeptech founders meet them constantly: advanced semiconductors, quantum components, lasers, sensors, drones, space hardware, specialised materials, high-end computing, encryption, certain chemicals and biological equipment all sit on control lists.

Three things surprise most founders:

1. "Export" includes technology, not just boxes. Emailing a design file, sharing a repository, giving a foreign engineer access to controlled data, or presenting detailed process know-how at a conference can be an export. In the US, sharing controlled technology with a foreign national inside the US is a "deemed export" to their home country.
2. Controls follow the item, not the company. A US-origin chip in your Indian product, or US-origin software in your design tools, can bring US rules with it when you re-export.
3. Penalties are serious and fast-growing, and investors, acquirers and large customers check compliance in diligence. A startup building controlled technology without a classification is a diligence red flag.

The main regimes:

• US: the Export Administration Regulations (EAR) for dual-use items, run by the Commerce Department's Bureau of Industry and Security (BIS), and the International Traffic in Arms Regulations (ITAR) for defence articles, run by the State Department.
• India: the SCOMET list (Special Chemicals, Organisms, Materials, Equipment and Technologies) under the Foreign Trade (Development and Regulation) Act, run mainly by the Directorate General of Foreign Trade (DGFT).
• UK: the Export Control Order 2008 and retained dual-use rules, run by the Export Control Joint Unit (ECJU).

All three build on the same international lists (the Wassenaar Arrangement, Missile Technology Control Regime, Nuclear Suppliers Group and Australia Group), so classifications usually line up, with national additions on top.

Who this is for: founders in semiconductors, quantum, photonics, space, drones, defence, advanced materials, AI compute, encryption, biotech equipment, or energy; anyone hiring foreign nationals, collaborating across borders, or selling hardware abroad.

Pairs with: 4.15 (JDAs with foreign partners), 4.14 (customer contracts), 4.19 (foreign investment rules) and 2.16 (open source, which interacts with "published" exclusions).

2. What has changed, and what the law says#

Controls on emerging technology have widened quickly since 2022.

• US. BIS added sweeping controls on advanced computing chips and semiconductor manufacturing equipment from October 2022, revised them repeatedly, and in September 2024 issued worldwide controls on quantum computers and related items, some semiconductor tools, and additive manufacturing items. It created a new licence exception (IEC) for countries with equivalent controls.
• US entity rules. On 29 September 2025, BIS issued an "Affiliates Rule" extending Entity List and Military End-User restrictions automatically to any company owned 50% or more by listed parties, as OFAC already does for sanctions. It suspended the rule for a year from November 2025 and, in November 2026, extended the suspension to 10 January 2027. Expect it to return; screening by ownership, not just by name, is becoming necessary.
• India. The SCOMET list gained a new Category 7, "Certain Emerging Technologies", effective 23 October 2025, covering advanced semiconductors, quantum technologies, cryogenic systems and related software and know-how. India has also eased some procedures: general authorisations for civilian drones (range up to 25 km and payload up to 25 kg), intra-company transfers, repairs and telecom items, and in November 2026 extended facilitation to 4- and 5-Star Export House status holders.
• UK. In April 2024 the UK added national controls on quantum, semiconductor and additive manufacturing items beyond the international lists.

The basic structure is the same everywhere:

1. Classify each product, software and technology against the control list. In the US that means an ECCN (such as 3A001 or 4A906), or "EAR99" if it is subject to the EAR but not listed; in India a SCOMET category (0–8); in the UK a control entry (such as 3A001, or a national "PL" entry).
2. Check the destination, end user and end use. A controlled item may need a licence for some countries but not others; any item may need a licence if the user is on a restricted list or the end use is military or weapons-related.
3. Get a licence, or use an exception or general authorisation, before the export happens.
4. Keep records (five years in the US under the EAR and ITAR; India and the UK set similar periods).

Technology and deemed exports. Under the EAR, releasing controlled technology or source code to a foreign national in the US is treated as an export to the person's most recent country of citizenship or permanent residence (15 CFR §734.13(b)). ITAR treats it the same way for defence technical data. India's SCOMET covers technology transfers, including intangible ones, from India. For a startup with an international team, this can mean licences are needed to hire.

Important exclusions. Information that is already published (freely available to the public), the results of fundamental research intended for publication, and information taught in general courses are generally outside the EAR (15 CFR §§734.3(b)(3), 734.7, 734.8). These exclusions are narrower under ITAR. Proprietary process know-how never qualifies.

Penalties.

• EAR: civil penalties, adjusted for inflation each year, reach several hundred thousand dollars per violation or twice the value of the transaction, whichever is greater. Criminal penalties reach $1 million and 20 years in prison.
• ITAR: civil penalties exceed $1 million per violation.
• Recent cases: Cadence Design Systems agreed in July 2025 to pay about $140 million to settle charges over exports to a Chinese military university, and BIS has announced a $252 million penalty against Applied Materials over semiconductor equipment exports.
• India: penalties under the FTDR Act and the WMD Act 2005 include fines, loss of the importer-exporter code, and imprisonment for serious breaches.

3. The method: a startup export compliance setup#

Step 1: Decide whether you are in scope (one hour)

Ask four questions:

1. Is our product, a component, our software or our technology in a field that appears on control lists (semiconductors, quantum, lasers, sensors, navigation, aerospace, drones, nuclear, specialised materials, encryption beyond standard, chemicals, biological equipment, high-performance computing)?
2. Does it contain US-origin parts, software or technology, or was it made with US tools in a way that might bring it under US rules?
3. Will we ship, upload, email or show technical information to anyone outside our country, or to foreign nationals inside it?
4. Do we have any defence, government security or space customers or partners?

If all four answers are no, document that and revisit yearly. If any is yes, continue.

Step 2: Classify#

For each product, major component, software release and body of technology, record the classification in each relevant regime:

• Self-classify using the control lists. Most items are not controlled, or are controlled only for a few destinations.
• Where unsure, ask the authority. BIS issues classification rulings (CCATS); DDTC issues commodity jurisdiction determinations (whether something is ITAR or EAR); DGFT accepts queries on SCOMET classification; the UK ECJU runs a free Control List Classification Advisory Service.
• Encryption is the most common trap for software and connected devices. Most commercial encryption falls under US ECCN 5A992 or 5D992 after a self-classification report, or under License Exception ENC. Check before shipping.

Keep a classification matrix: item, version, ECCN or category, reason for control, date, who classified it.

Step 3: Screen every counterparty#

Screen customers, distributors, partners, investors' portfolio links where relevant, and freight forwarders against restricted-party lists: the US Consolidated Screening List (including the Entity List and the SDN list), the UK sanctions list, the EU consolidated list, and India's lists of restricted entities. Free and paid screening tools exist. With the US Affiliates Rule returning, screen for ownership (50%+ by listed parties) as well as names.

Step 4: Control technology access#

• Mark controlled documents and repositories.
• Restrict access by role and nationality where licences require it.
• For foreign-national hires in the US who need controlled technology, apply for a deemed-export licence before they start on that work. Plan for 30–90 days.
• Use a technology control plan for visitors, interns and collaborators.
• Don't present controlled process details at conferences unless the information is already published.

Step 5: License or use exceptions#

Apply for licences early. Typical times: US BIS licences often take 30–60 days or more for sensitive items; DDTC licences similar or longer; India SCOMET authorisations commonly take several weeks to a few months, depending on the inter-ministerial review; UK SIELs (standard individual export licences) have a target of 20 working days for most cases, often longer for sensitive ones. Check whether a general authorisation or licence exception fits first.

Step 6: Put it in your contracts#

Add export control clauses to customer, distributor and JDA contracts: each party complies with applicable export laws; the customer will not re-export to prohibited destinations or end users; end-use statements where needed; the right to suspend if a licence is refused or revoked.

Step 7: Assign an owner and keep records#

Name one person responsible. Keep classification records, screening results, licences and shipping documents for at least five years. Train anyone who ships, shares technical data or hires.

Worked example#

PhotonQ, a Bengaluru startup with a Delaware parent, builds single-photon detectors for quantum key distribution. It has a team of 12, including two Chinese nationals working in a US lab, and a pilot customer in Germany.

1. Classification. Its detectors fall under US quantum-related controls added in 2024 and under India's SCOMET Category 7 from October 2025. The firmware contains standard encryption.

2. Licences needed. The detectors are made in India with one US-origin component. PhotonQ needs a SCOMET authorisation for the German shipment. Its US counsel confirms that the US content is below the de minimis threshold for Germany, so no US re-export licence is needed for this shipment, though it would be for some other destinations. For any direct US exports, counsel checks whether Germany is on the IEC eligibility table for the relevant items.

3. Deemed exports. The two engineers in the US lab cannot access detector design files until BIS grants deemed-export licences. PhotonQ applies, and assigns them to noncontrolled work meanwhile.
4. Diligence. At seed, the US lead investor's lawyers review the classification matrix, the SCOMET authorisation and the deemed-export licences. Because everything is documented, the review takes days. Had the design files been shared freely with the

US-based foreign nationals, PhotonQ would likely have needed a voluntary selfdisclosure to BIS before the round could close.

4. The regimes in more detail#

US points.

• ITAR is strict. If anything you make was designed for a military application, or is listed on the USML, assume ITAR until a commodity jurisdiction ruling says otherwise. ITAR technical data generally cannot be shared with foreign persons, including employees, without authorisation.
• Foreign ownership. For ITAR-registered companies, foreign ownership or control has to be notified, and foreign investment in companies working on critical technologies can trigger a CFIUS review (4.19). Indian or other foreign founders of a US company should take advice early.
• The Affiliates Rule. Its suspension now runs to 10 January 2027. Prepare to screen by ownership.

India points.

• Before exporting anything technical, check SCOMET. This includes samples for testing, demo units, and technology transfers to a foreign parent.
• Exhibitions and testing. DGFT has procedures for temporary exports for exhibitions, tenders and testing; use them rather than shipping "samples" informally.
• Intra-company transfers. Since 2023–24 there are global authorisations for intracompany transfers of some SCOMET items and technology, useful for companies with foreign subsidiaries or parents. Check eligibility.
• Indian controls also apply to some imports under end-use certificates for US- or EUorigin controlled items, which the foreign exporter may require from you.

UK points.

• Use the ECJU's free classification advice service, and the "goods checker" tool.
• OGELs cover many common cases and are free to register for, but each has conditions and record-keeping duties.
• UK national controls added in 2024 cover quantum computers and components, some semiconductor manufacturing equipment, and additive manufacturing equipment, beyond the international lists.

Sanctions are separate. Export controls govern what you export. Sanctions (OFAC in the US, OFSI in the UK, the EU and the UN) restrict who you deal with and where , whatever the item. Comply with both.

5. Scripts, mistakes, related playbooks, sources#

Scripts#

Asking a supplier for classification of a component:

"We're integrating your [part] into a product we'll export from [country]. Could you send us the ECCN and country of origin for [part number], and confirm whether it's subject to the EAR or ITAR? We need it for our export classification."

Briefing an export control lawyer:

"We make [product], using [key technologies], with components from [countries]. Our team includes nationals of [countries] working in [countries]. We plan to sell to [customer types] in [countries] in the next 18 months. We'd like a classification of our products and technology, a view on deemed-export issues for our team, and a short compliance plan."

In a customer contract:

"Each party will comply with all applicable export control and sanctions laws. Customer will not export, re-export or transfer the Products or Technical Data to any country, person or end use prohibited by those laws without the required authorisation, and will provide end-use and end-user information reasonably requested by Supplier."

When a customer you've never heard of asks for an urgent shipment to a third country:

Stop and check the red flags: an unclear end use, a payment from an unrelated country, a request to avoid normal shipping, an end user who doesn't fit the product. Screen them, ask for an end-use statement, and don't ship until you're satisfied.

Common mistakes#

1. Assuming export controls are only for weapons. Most controlled items are dual-use.
2. Forgetting technology: emails, repositories, cloud access and conference talks.
3. Deemed exports in the US: giving foreign-national staff controlled technology without a licence.
4. Ignoring US content in non-US products.
5. No classification records, so diligence stalls.
6. Shipping "samples" or demo units informally.
7. Screening names but not ownership, as the US Affiliates Rule returns.
8. Treating encryption as harmless without a classification.
9. Mixing ITAR and non-ITAR work without separation, which can drag everything under ITAR.
10. Not asking for advice early: classification rulings and licences take weeks to months.

Related playbooks#

• 2.16 Open source or proprietary
• 4.03 Flipping to a Delaware holding company, and reverse-flipping back to India
• 4.14 Customer contracts: MSAs, SOWs and pilot agreements
• 4.15 Joint development agreements and who owns co-developed IP
• 4.19 FEMA, FDI and ODI rules for foreign money
• 4.20 Litigation and IP dispute basics

Sources#

• US: Export Administration Regulations, 15 CFR Parts 730–774 (including §§734.3, 734.7, 734.8, 734.13); ITAR, 22 CFR Parts 120–130.
• BIS Affiliates Rule (29 September 2025) and suspensions: Willkie, JD Supra, Global Sanctions, November 2026.
• BIS quantum and semiconductor controls (September 2024): ST&R summary.
• India: Foreign Trade (Development and Regulation) Act 1992; WMD Act 2005; SCOMET list (Appendix 3 to Schedule 2 of ITC(HS)); DGFT Handbook of Procedures, Chapter 10; [Handbook on India's Strategic Trade Control System, 3rd ed. (January

2026](https://www.mea.gov.in/images/NCSTC-2025-Handbook-on-Indias-Strategic-Trade-Control-System.pdf)); Trilegal on Category 7; TaxGuru on Public Notice 36/2026-27.

• UK: Export Control Order 2008; Export Control (Amendment) Order 2024; ECJU guidance.