What Is the EAR? A Guide to the Export Administration Regulations for Non-U.S. Companies

The EAR (Export Administration Regulations) is the body of U.S. federal rules that governs the export, reexport and in-country transfer abroad of dual-use goods, software and technology, as well as certain less sensitive military items. It is administered by the Bureau of Industry and Security (BIS), an agency of the U.S. Department of Commerce.

Unlike most export rules, the EAR does not apply only to transactions that originate in the United States. It can reach companies that have never set foot on U.S. soil, whether because they use U.S.-origin components or software, because they make products derived from U.S. technology, or because they deal with restricted counterparties. Understanding when the EAR applies and what happens when it is breached is an essential first step for any non-U.S. company with international operations.

This guide explains what the EAR regulates, the routes through which a non-U.S. company can become subject to it, how the Commerce Control List and ECCNs work, what penalties apply in 2025 and what operational steps an organization must take to comply.

If your company exports, reexports or transfers goods containing U.S.-origin components, see our EAR and export controls advisory service.

What is the EAR and what does it regulate?

The EAR regulates three types of transactions: the export of goods, software and technology from the United States to another country; the reexport of those same items between two third countries; and transfers within a single foreign country. Its current legal basis is the Export Control Reform Act of 2018 (ECRA), which replaced the earlier Export Administration Act.

The operating principle of the EAR is that “the law follows the goods”. If a product is subject to the EAR because of its origin or its controlled content, that status travels with the product wherever it goes, no matter how many borders it crosses or how many intermediaries are involved.

What BIS is and its role under the EAR

The Bureau of Industry and Security (BIS) is the Commerce Department agency that drafts, interprets and enforces the EAR. Its functions include issuing export licenses, maintaining lists of restricted parties (Entity List, Military End User List, Unverified List), carrying out inspections and imposing administrative penalties for violations.

BIS also coordinates criminal investigations of serious violations with the Department of Justice (DOJ) and is part of the Disruptive Technology Strike Force, an interagency team created to protect advanced technology from unauthorized acquisition by foreign actors.

What types of products the EAR covers

The EAR mainly covers commercial and dual-use items, with both civilian and military applications. It does not apply to pure weaponry or to defense articles specifically designed for military use, which fall under the ITAR, administered by the Department of State.

Typical categories subject to the EAR include advanced electronics and semiconductors, software and technology with encryption capabilities, telecommunications equipment, sensors and navigation equipment, chemical and biological materials with potential dual use, civil aviation, and a long list of commercial goods that may have a secondary military application. Products with no apparent military capability can also be controlled if they are destined for sanctioned countries or for restricted end users or end uses.

The EAR compared with the ITAR and OFAC sanctions

The EAR, the ITAR and OFAC sanctions are three separate regulatory frameworks that can apply to the same transaction at the same time. Telling them apart is the first step in understanding a company’s real exposure.

A single transaction can breach all three at once. For example, exporting a semiconductor with U.S. components to an Iranian entity involves: an EAR violation (controlled item to a sanctioned destination), a possible ITAR violation (if the chip has military specifications) and a breach of OFAC sanctions (Iran is under a comprehensive embargo). To go deeper into each framework, see the guide to OFAC sanctions and the guide on what the ITAR is and when it affects defense companies.

How a non-U.S. company becomes subject to the EAR

A company with no headquarters, parent or direct operations in the United States can become subject to the EAR through several specific routes: an inventory of U.S.-origin goods, the de minimis rule for controlled content, the Foreign Direct Product Rule (FDPR) and the new 50% Affiliates Rule, in force since September 2025 but suspended until November 2026. Identifying which of these routes an organization is exposed through is the starting point of any compliance analysis.

Route 1: U.S.-origin goods in your inventory

Any item made in the United States remains subject to the EAR even after it has left the country. If a European or Latin American company holds a U.S.-origin product in its warehouse and reexports it to a third country, that transaction requires BIS authorization if the destination, end use or end user is subject to control.

The typical case: a Spanish company buys components from a U.S. manufacturer, keeps them in inventory and reexports them to a customer in a third country. If that third country is a controlled destination for that product, or if the counterparty is on the Entity List, the Spanish company needs a BIS license, even though it has never operated in the United States.

Route 2: The de minimis rule (10% and 25% thresholds)

The de minimis rule determines when a product made outside the United States becomes subject to the EAR because it incorporates controlled U.S.-origin content. The general threshold is 25% of the total value of the finished product. If controlled U.S.-origin content exceeds that percentage, the foreign product is subject to the EAR.

For especially sensitive destinations (Cuba, Iran, North Korea and Syria), the threshold drops to 10%. This means that a product made in Spain with just 11% controlled U.S. content cannot be exported to Cuba without a BIS license.

Calculating controlled content is not trivial: it requires identifying which components are classified on the Commerce Control List, calculating their adjusted value and comparing it with the total value of the finished product. Many non-U.S. companies discover that they exceed the de minimis threshold when they carry out their first serious export audit.

Route 3: Foreign Direct Product Rule (FDPR)

The Foreign Direct Product Rule (FDPR) extends EAR jurisdiction to products made entirely outside the United States when they were produced using U.S.-origin software, technology or production equipment. Under this rule, a chip made in Spain with U.S.-origin machinery can be subject to the EAR even if it contains not a single gram of U.S. material.

The FDPR is the mechanism the United States has used to restrict the supply of advanced semiconductors to entities such as Huawei and to destinations such as Russia. Given how common U.S. equipment is in semiconductor fabs worldwide, practically any advanced chip in the world can be caught by one FDPR or another.

FDPR analysis is technically complex and intersects with product classification, end use and end user. For a full treatment with industry examples, see the guide to the Foreign Direct Product Rule.

Route 4: The 50% Affiliates Rule (September 2025)

The 50% Affiliates Rule is a BIS rule published on September 30, 2025, effective from September 29, 2025 but suspended until November 10, 2026. It extends certain EAR restrictions to any foreign entity that is 50% or more owned, directly or indirectly, individually or in the aggregate, by one or more entities on the Entity List or the Military End User List, or by most persons on the SDN List subject to controls under EAR § 744.8.

Before this rule, BIS restrictions were limited to the entities specifically listed. Now they also apply to their subsidiaries and controlled companies, even if those subsidiaries do not appear on any public list. The rule aligns BIS practice with the 50% rule that OFAC has applied to the SDN List for years.

For a non-U.S. company, this means that checking a counterparty against the official lists is no longer enough. You now also have to investigate its ownership structure, which significantly raises the standard of due diligence expected. To understand how this rule works for the SDN List specifically, see the guide on what OFAC’s SDN List is.

The Commerce Control List (CCL) and ECCNs

The Commerce Control List (CCL) is the official BIS catalog listing all products, software and technologies controlled under the EAR. Each entry on the CCL is assigned an Export Control Classification Number (ECCN), a five-character alphanumeric code that precisely identifies the nature of the item and the reasons for control.

Classifying a product correctly is the first operational step of any compliance program. A classification error can lead to exporting without a license an item that required one or, conversely, to seeking a license for a product that does not need one.

How an ECCN is structured

An ECCN has five characters with a fixed structure. The first digit is a category (0 to 9) that identifies the general nature of the product: nuclear materials, materials and chemicals, materials processing, electronics, computers, telecommunications and information security, sensors and lasers, navigation and avionics, marine, or aerospace and propulsion.

The letter identifies the product group: A for equipment, assemblies and components, B for test, inspection and production equipment, C for materials, D for software and E for technology. The last three characters specify the particular reason for control and the specific subtype.

A practical example: ECCN 3A001 covers electronic components with specific technical characteristics that pose a national security risk. ECCN 5D002 covers software with encryption capabilities. The official BIS website publishes the full CCL with technical descriptions of each ECCN.

For a detailed analysis of ECCN classification in specific sectors such as semiconductors, AI software or industrial equipment, see the guide to ECCN classification and dual-use technology.

What EAR99 means and why “not controlled” does not mean “no obligations”

The EAR99 designation applies to products that fall under EAR jurisdiction but are not specifically controlled by any ECCN on the CCL. Most low-tech commercial goods receive this classification. Under normal conditions, an EAR99 product can be exported without a license under the No License Required (NLR) designation.

The common mistake is to assume that EAR99 means “not subject to the EAR”. It is the opposite: an EAR99 product remains under EAR jurisdiction, and exporting it still requires checking the destination, end use and end user. For example, an EAR99 product cannot be freely exported to Cuba or North Korea. Nor can it be shipped without a license to an entity on the Entity List, or to an end user involved in weapons of mass destruction proliferation programs.

In practice, EAR99 simplifies the technical side (there is no need to analyze an ECCN’s specific reasons for control) but leaves counterparty screening and end-use assessment obligations fully intact.

Consequences of breaching the EAR

Breaching the EAR can lead to three types of consequences: administrative civil penalties imposed by BIS, criminal penalties prosecuted by the Department of Justice, and loss of export privileges, which bars the company from taking part in any transaction subject to the EAR. All three can be imposed for the same conduct.

Civil penalties

Since January 15, 2025, the maximum administrative civil penalty for an EAR violation is $374,474 per violation or twice the value of the transaction, whichever is greater. This amount is adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act.

BIS applies penalties per violation, not per case. A transaction involving multiple shipments can give rise to hundreds or thousands of separate violations, multiplying the final amount. This is how companies such as Seagate Technology have ended up paying several hundred million dollars.

Criminal penalties

Willful violations of the EAR are prosecuted under ECRA 2018 and can carry up to $1 million in fines per violation and up to 20 years in prison. Criminal penalties apply where there is evidence of intentional misconduct: concealing destinations, falsifying export documents, using intermediaries to get around controls or conspiring to evade the EAR.

Criminal penalties can be imposed on top of civil ones. A company can pay a BIS administrative penalty and, at the same time, see its executives individually prosecuted by the DOJ.

Loss of export privileges

BIS has authority to issue Denial Orders and Temporary Denial Orders (TDOs) that bar a person or company from taking part in any transaction subject to the EAR. A Denial Order cuts the company off from the U.S. export ecosystem: it cannot export, it cannot receive reexports, and any third party that does business with it risks being penalized too.

TDOs are issued as an interim measure in high-risk cases and can be renewed periodically while the investigation continues. For a company that depends on U.S. components or technology, a Denial Order can be a more devastating operational sanction than the fine itself.

Real enforcement cases

The following list covers documented BIS penalties against foreign companies or involving products made outside the United States:

• Seagate Technology Singapore: $300 million (April 2023). Seagate Singapore and its U.S. parent were penalized for shipping millions of hard drives to Huawei without a license, in violation of the Huawei-specific FDPR. It is the largest standalone administrative penalty in BIS history.
• TE Connectivity Corporation: $5.8 million. The company and its Hong Kong subsidiary were penalized for shipping low-level components to Entity List parties linked to Chinese hypersonics, UAV and military electronics programs. The case shows that even seemingly minor products lead to significant penalties when the end user is restricted.
• Aratos Group (Netherlands/Greece): TDO (June 2023). BIS suspended the export privileges of this network of defense-sector companies and its president for acting as a procurement network for Russian intelligence services. The case was coordinated with a DOJ criminal indictment in the Eastern District of New York.
• Russian airlines (Nordwind, Siberian, Ural, among others): TDOs (since February 2022). BIS has issued multiple TDOs against Russian airlines for operating aircraft with more than 25% controlled U.S. content on flights to and from Russia, in violation of the controls imposed after the invasion of Ukraine.

In our experience advising European companies with EAR exposure, the most common trigger is not a direct shipment to a sanctioned destination. It is the routine reexport of a U.S.-origin component built into a finished product without a properly documented de minimis analysis, or the export of products made with U.S. technology or equipment without analyzing the foreign direct product rule.

What a non-U.S. company must do to comply with the EAR

Complying with the EAR as a non-U.S. company requires at least four operational steps, carried out in order: classify products on the Commerce Control List, screen counterparties against the official lists, determine whether the transaction requires a BIS license, and design a documented, auditable compliance program. Each step depends on the one before.

Step 1: Classify products on the CCL

Classification means determining, for each exportable product, whether it has an ECCN on the CCL or falls under EAR99. This analysis must be technically rigorous: compare the product’s actual specifications (performance, capabilities, materials) with the criteria described in each candidate ECCN.

Classification can be done in-house if the company has qualified technical staff and up-to-date access to the CCL, or it can be requested from BIS through the Commodity Classification Automated Tracking System (CCATS) procedure, which issues an official, binding classification.

Step 2: Screen counterparties against the official lists

Before any transaction, the company must screen every counterparty (customer, intermediaries, freight forwarders, ultimate consignee, end user) against the restricted party lists maintained by BIS and other agencies. The relevant lists include the Entity List, Military End User List, Unverified List, Denied Persons List and OFAC’s SDN List. BIS also publishes the Consolidated Screening List, which brings the main lists together.

Since the Affiliates Rule took effect in September 2025, even though it is currently suspended until November 10, 2026, list screening is no longer enough. You also need to investigate the counterparty’s ownership structure to detect whether it is 50% or more controlled by listed entities. For a detailed look at this process, see the guide to counterparty due diligence.

Step 3: Determine whether a license is needed

Once the product is classified and the counterparties identified, the combination of ECCN, destination, end use and end user determines whether the transaction requires a prior BIS license. Some combinations require no license, others can rely on a License Exception, and others require a formal application and a wait for the decision.

Specific licenses can take weeks or months to be decided, which has a direct impact on commercial timelines. For a full analysis of the licensing process, available license types and real timelines, see the guide to BIS export licenses.

Step 4: Design a compliance program

BIS expects non-U.S. companies with EAR exposure to implement a formal compliance program covering, at a minimum, management commitment, risk assessment, internal controls, staff training, and periodic auditing and testing. These five components are the same ones OFAC requires in its Framework for OFAC Compliance Commitments, which makes it possible to design an integrated program covering both regimes.

A robust program is a mitigating factor when a violation occurs. BIS can reduce the penalty by up to 50% when the company has a documented program and files a Voluntary Self-Disclosure. For full details of the five components of a compliance program, see the guide to OFAC, EAR and ITAR compliance programs.

Frequently asked questions about the EAR

Does the EAR apply to companies without a U.S. presence?

Yes. The EAR can apply to non-U.S. companies through four routes, among others: when they hold U.S.-origin goods in inventory; when they make products with controlled U.S. content above the de minimis thresholds (10% or 25%); when they use U.S.-origin technology or software to make products under the Foreign Direct Product Rule; and, since September 2025 (although suspended until November 10, 2026), when they or their counterparties are 50% or more controlled by entities on the Entity List, the Military End User List or the SDN List under the new Affiliates Rule.

What is the difference between the EAR and the ITAR?

The EAR regulates dual-use goods, software and technology and less sensitive military items; it is administered by BIS and classifies products on the Commerce Control List using ECCN codes. The ITAR regulates specifically military articles and services; it is administered by the State Department’s DDTC and lists products on the United States Munitions List (USML). The ITAR is more restrictive and its maximum civil penalties are higher: $1,271,078 per violation versus $374,474 under the EAR.

What does EAR99 mean?

EAR99 is the designation for products subject to the EAR that are not specifically controlled by any ECCN on the Commerce Control List. Most low-tech commercial goods are EAR99. These products can usually be exported without a license under the No License Required designation, but they remain subject to the EAR as regards counterparty, destination and end-use screening. For example, an EAR99 product cannot be exported without a license to Cuba, North Korea or restricted end users or end uses.

What is the 50% Affiliates Rule?

The 50% Affiliates Rule is a BIS rule published on September 30, 2025 and effective from September 29, 2025, but suspended until November 10, 2026. It extends EAR restrictions to any foreign entity that is 50% or more owned, directly or indirectly, individually or in the aggregate, by entities on the Entity List or the Military End User List, or by persons on the SDN List subject to controls under EAR § 744.8. Before this rule, only the entities specifically listed were restricted. Now their subsidiaries and controlled companies are too, even if they do not appear on any public list.

What happens if my customer is on the Entity List?

If a customer or counterparty is on the Entity List, any export or reexport of an item subject to the EAR to that entity, or involving that entity, requires a prior BIS license. BIS usually applies a presumption of denial to listed entities, which means licenses are rarely granted. Since September 2025 (suspended until November 10, 2026), the restriction also extends to any company 50% or more controlled by the listed entity, even if that subsidiary does not appear on the list. A company that detects a listed customer should stop the transaction, document the finding and assess whether a voluntary self-disclosure to BIS is appropriate.

How can I find out my product’s ECCN?

There are three ways to determine a product’s ECCN. The first is to ask the original manufacturer, which usually has the classification on file. The second is to classify it internally by comparing the product’s technical specifications with the criteria of each candidate ECCN on the CCL published by BIS. The third is to request an official classification from BIS through the Commodity Classification Automated Tracking System (CCATS) procedure, which issues a binding classification after reviewing the technical documentation provided. For complex or high-tech products, the third route is the safest option.

Assess your company’s EAR exposure with our free checklist

Determining whether your company is subject to the EAR, through which route and to what extent requires a structured analysis of inventory, counterparties, destinations and end use. We have prepared an OFAC, EAR and ITAR risk checklist that covers the critical points of this analysis in an auditable format.

Download the OFAC/EAR/ITAR Risk Checklist (in Spanish) and assess whether your products, components or technologies could be subject to the EAR, which counterparties you should screen and what documentation you need to prepare before a first consultation with a specialist.