What Is ITAR? U.S. Export Regulations for Defense Articles

The ITAR (International Traffic in Arms Regulations) is the set of U.S. Department of State regulations that controls the international flow of military and defense technology. It covers the export, temporary import and reexport of articles, services and technical data listed on the USML (United States Munitions List). It is codified at 22 CFR Parts 120-130 and implements the Arms Export Control Act (22 USC § 2778). It is administered by the DDTC (Directorate of Defense Trade Controls).

A non-U.S. company can become subject to the ITAR even if it has never operated on U.S. soil. The rule is functional: if the product, data or service is on the USML, the ITAR follows it wherever it goes. Reexporting a USML component, transferring it to a third country or giving a non-U.S. person access to technical data can amount to a violation. In 2025, civil penalties reach $1,271,078 per violation.

What the ITAR is and its legal framework

The ITAR is one of the two major U.S. export control regimes and governs the international flow of U.S. military and defense technology. It is part of Title 22 of the Code of Federal Regulations (CFR), which covers U.S. foreign relations. Its stated purpose is to protect the country’s national security and foreign policy objectives.

The ITAR does not operate in isolation. It rests on three legal pillars: the AECA (Arms Export Control Act) as the enabling statute, the USML as the list of controlled items and data, and the DDTC as the administering authority.

The AECA and the origins of the ITAR

The AECA (22 USC § 2778) is the federal law that authorizes the President to control the export and import of defense articles and services. It was passed in 1976, at the height of the Cold War, to channel U.S. arms exports toward coherent diplomatic objectives. The ITAR is the implementing regulation that puts the AECA’s provisions into effect.

The distinction matters. When a company talks about an “ITAR violation”, it is technically breaching two sets of rules at once: the administrative regulation (ITAR) and the statute (AECA). That is why official State Department announcements always cite both.

The DDTC: the agency that administers the ITAR

The DDTC (Directorate of Defense Trade Controls) is the U.S. Department of State office responsible for administering the ITAR. It is part of the Bureau of Political-Military Affairs. Its three main functions are classifying articles on the USML, granting defense export licenses and imposing civil and administrative penalties for violations.

The DDTC operates through DECCS (Defense Export Control and Compliance System), the online platform where companies register and apply for licenses. Physical enforcement of ITAR rules is carried out by Homeland Security Investigations special agents.

What the ITAR regulates: the three categories of controlled activity

The ITAR regulates three types of activity: the export of physical defense articles, the provision of defense services and the transfer of technical data related to the USML. All three categories are subject to the same licensing regime and the same civil and criminal penalties.

Defense articles

Defense articles are physical items specifically designed, developed, configured, adapted or modified for a military application. The definition is at 22 CFR § 120.31. It includes weapons, platforms, components and subcomponents listed in any of the 21 USML categories.

The ITAR does not require the article ever to have been used in a military context. It is enough that it was designed for that purpose. An electronic component originally developed for a missile is subject to the ITAR even if someone later tries to sell it on a civilian market.

Defense services

Defense services are any assistance, training or consulting provided to a foreign person in connection with a defense article. The definition is at 22 CFR § 120.32. It covers the design, development, manufacture, modification, repair, maintenance and use of the article.

This point is critical for non-U.S. companies whose engineers advise defense customers, install USML equipment or train operators. A technician who travels to configure a system classified as a defense article is providing a defense service. The obligation applies even if neither the trip nor the training involves moving any hardware.

Technical data

Technical data is the information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. The operative definition is at 22 CFR § 120.33. It includes blueprints, technical drawings, software, documentation, formulas, manuals and, more generally, any information that qualifies as know-how.

The concept that most surprises non-U.S. companies is the “deemed export”. Sharing USML technical data with a non-U.S. person, even inside the United States or by email, is treated as an export. A Brazilian engineer hired by a U.S. subsidiary can receive technical data only if the company holds the corresponding license or exemption.

What the USML is and how to tell whether your product is on it

The USML (United States Munitions List) is the list codified at 22 CFR § 121.1 that sets out the articles, services and technical data subject to the ITAR. It is divided into 21 categories. If a product, software or technical document fits any of them, it automatically falls under ITAR jurisdiction.

The 21 USML categories

The USML categories cover the full spectrum of modern weaponry and of technologies with an exclusively military application:

• I: Firearms and close assault weapons
• II: Guns and armament
• III: Ammunition
• IV: Launch vehicles, guided missiles, ballistic missiles, rockets, torpedoes, bombs and mines
• V: Explosives and energetic materials, propellants
• VI: Surface vessels of war and special naval equipment
• VII: Ground vehicles
• VIII: Aircraft and related articles
• IX: Military training equipment
• X: Personal protective equipment
• XI: Military electronics
• XII: Fire control, laser, imaging and guidance equipment
• XIII: Materials and miscellaneous articles
• XIV: Toxicological agents and chemical-biological equipment
• XV: Spacecraft and related articles
• XVI: Nuclear weapons related articles
• XVII: Classified articles, technical data and defense services not otherwise enumerated
• XVIII: Directed energy weapons
• XIX: Gas turbine engines and associated equipment
• XX: Submersible vessels and related articles
• XXI: Articles, technical data and defense services not otherwise enumerated

Civilian sectors that can be affected

The ITAR does not only affect arms manufacturers. Companies in seemingly civilian sectors can touch the USML because of the nature of their components or processes. The four areas with the greatest indirect exposure are specialized electronics (Category XI), aerospace (Categories VIII and XV), turbine engines (Category XIX) and optical and imaging technologies (Category XII).

Until 1996, even civilian cryptography was classified as a USML defense article. Technologies are reclassified all the time: what is under the EAR today may move to the ITAR tomorrow, and vice versa. Any company with products on the boundary between civilian and military should revalidate jurisdiction periodically.

When the ITAR applies to a non-U.S. company

The ITAR applies to a non-U.S. company when it obtains, uses, reexports or retransfers USML articles, provides defense services, accesses USML technical data or brokers defense transactions. Jurisdiction is functional, not territorial: what matters is what is done with the item or the data, not where the company is.

Non-U.S. companies tend to underestimate this point because they associate U.S. regulation with a physical presence in the United States. The AECA and the ITAR were designed precisely to cover the international movement of U.S.-origin defense articles.

Reexports and retransfers (transfers between third countries)

A reexport occurs when a company outside the United States ships a USML article to a third country. A retransfer occurs when that same article changes end user within the same non-U.S. country. Both require prior DDTC authorization.

A European company that receives USML components from a U.S. supplier cannot freely resell them. Any subsequent movement is subject to the original export conditions and may require a new ITAR license.

Access to technical data by foreign persons

Access to USML technical data by non-U.S. persons is one of the most common violations documented by the DDTC. The rule applies to employees, contractors, interns and even visitors with access to digital files or printed documentation.

A non-U.S. company with a multinational workforce must segregate access to USML technical data by nationality. Authorizing a foreign person to access technical data usually requires a specific DDTC license or a documented exemption.

Brokering of defense articles (ITAR Part 129)

Brokering, regulated at 22 CFR Part 129, is the activity of acting as an intermediary in transactions involving defense articles or services, including financing, transportation, freight forwarding or commercial promotion. ITAR brokering obligations apply mainly to U.S. entities, entities located in the U.S. and non-U.S. entities controlled by U.S. persons. In those cases, non-U.S. brokers must also register with the DDTC and obtain authorization for their transactions.

Registration as a broker is separate from registration as a manufacturer or exporter. A company can act solely as an intermediary and still be fully subject to the ITAR.

Real case: the 2024 RTX settlement

In August 2024, the U.S. Department of State concluded an administrative settlement with RTX Corporation (formerly Raytheon) to resolve 750 violations of the AECA and the ITAR. The agreed civil penalty was $200 million, of which $100 million was suspended in exchange for remedial measures in the company’s compliance program. The 36-month agreement required the appointment of an external Special Compliance Officer and at least one external audit of the ITAR program.

The case illustrates two key points for any company exposed to the ITAR. First, the financial scale: $200 million in a single administrative action. Second, the structural consequences. ITAR penalties are rarely just monetary. They almost always include extended external oversight and mandatory changes to internal organization.

EAR and ITAR: the key difference for non-U.S. companies

The main difference between the EAR and the ITAR lies in the nature of the controlled item. The EAR (Export Administration Regulations) covers dual-use items, with civilian and military applications, under the authority of the Department of Commerce. The ITAR covers purely defense items, under the authority of the Department of State. The two regulations run in parallel and rarely overlap.

The other branch of the system follows a different logic. For more on the EAR regime and the CCL, see our article on the Export Administration Regulations.

Consequences of breaching the ITAR

Breaching the ITAR leads to three types of consequences: administrative civil penalties, criminal penalties including prison, and debarment, which bars the party from defense trade. All three can be imposed together for the same conduct.

Civil penalties (administrative fines)

The DDTC imposes civil penalties under the AECA without having to prove intent. The maximum per violation, adjusted for 2025, is $1,271,078 or twice the value of the transaction, whichever is greater. Each unauthorized transaction counts as a separate violation, so multimillion-dollar totals build up quickly.

Most civil penalty cases are resolved through a Consent Agreement, an administrative settlement that combines the fine with mandatory remedial measures. These agreements usually last between 30 and 48 months and include the appointment of an external compliance officer and independent audits.

Criminal penalties (DOJ prosecution)

Criminal penalties apply to willful violations, meaning those committed with knowledge of, or deliberate disregard for, their unlawfulness. The Department of Justice (DOJ) prosecutes them under the AECA. The maximum penalty per violation is $1,000,000 and up to 20 years in prison.

ITAR criminal cases are often combined with charges of conspiracy, false statements or smuggling, which increases overall criminal exposure. Foreign companies are not immune: the DOJ has prosecuted executives and entities outside the United States for reexport schemes or fraudulent acquisition of USML technology.

Statutory debarment vs. administrative debarment

Debarment bars an individual or company from taking part, directly or indirectly, in trade in defense articles or services. There are two forms. Statutory debarment is automatic and mandatory after a criminal conviction for violating the AECA. Administrative debarment is discretionary and is imposed by the DDTC after an administrative proceeding, with no prior criminal conviction required.

For a company specializing in defense, debarment means being shut out of the U.S. market and, by extension, any market that depends on U.S.-origin technology. Reinstatement of export privileges is not automatic: it requires a formal request to the Department of State.

Voluntary disclosure as a mitigating factor

A voluntary disclosure is the voluntary reporting of a violation to the DDTC before the agency detects it on its own. The DDTC expressly recognizes it as a mitigating factor in determining administrative penalties. The rule is at 22 CFR § 127.12.

A voluntary disclosure does not guarantee exoneration, but it can significantly reduce the penalty and, in some cases, prevent criminal proceedings from being opened. Companies with mature compliance programs tend to use it when an internal audit uncovers a previously unnoticed violation.

Basic steps for a non-U.S. company exposed to the ITAR

A non-U.S. company with potential ITAR exposure should verify the jurisdiction of its products, map its supply chain and formalize a basic compliance program. The order matters: starting with licenses before knowing whether the product is on the USML is one of the most common sources of error.

Jurisdictional analysis of products

The first step is to determine whether the company’s products, software or technical data are on the USML, on the CCL or on neither. This classification is not optional: it shapes the entire compliance structure that follows and defines which agency has jurisdiction.

When in doubt, the ITAR allows you to request a Commodity Jurisdiction (CJ) determination from the DDTC. This is the formal procedure for obtaining a binding answer on whether a specific product is subject to the ITAR or the EAR.

Supply chain mapping

The second step is to identify every point where the company touches USML articles, USML technical data or defense services. This includes suppliers, distributors, subsidiaries, integrators and technology partners. Each node is a potential point of exposure and should be reflected in the risk matrix.

The chain does not end with the end customer: the contractual reexport and retransfer clause requires you to control what happens to the item after delivery. The most serious violations tend to occur in these downstream transactions.

Basic compliance program

The third step is to formalize an ITAR compliance program. It has five minimum components: management commitment, risk assessment, internal controls, internal auditing and regular training. The structure matches the five components of an OFAC and BIS compliance program, which makes it possible to integrate all three regimes into a single framework.

Choosing and obtaining the specific licenses for each regulated transaction is the next logical step once the basic program is up and running. We cover that process in a dedicated article on BIS and DDTC export licenses.

Frequently asked questions about the ITAR

What happens if a European company receives ITAR-controlled technical data from a U.S. supplier?

The European company must handle that data in accordance with the ITAR. It cannot share it with non-U.S. persons without the corresponding authorization, or reexport it to third countries without a new DDTC license. The original export conditions travel with the data and remain in place indefinitely until the classification changes or a specific authorization is obtained.

Is being “ITAR certified” the same as complying with the ITAR?

No. There is no such thing as ITAR certification. What exists is the obligation to register with the DDTC or obtain DDTC authorizations (where applicable) and to meet the regime’s substantive requirements. Any provider offering “ITAR certification” as a commercial product is using a label with no regulatory basis. Compliance is demonstrated with a documented program, not with a seal.

When is a voluntary disclosure to the DDTC mandatory?

A voluntary disclosure is, by definition, voluntary. However, the ITAR does impose specific reporting obligations in two situations: violations involving the proscribed countries listed at 22 CFR § 126.1 (including countries under arms embargoes) and temporary exports not returned within the required time frame. In those cases, notifying the DDTC stops being a strategic choice and becomes a regulatory obligation.

Does the ITAR have a de minimis rule like the EAR?

No. The EAR’s de minimis rule allows foreign products with 10% or 25% or less controlled U.S.-origin content to be excluded. The ITAR has no such rule. If a USML component is built into a foreign product, the resulting product is subject to the ITAR regardless of what percentage of total value the USML component represents.

Conclusion: the ITAR as a strategic risk, not a technical one

The ITAR is not just an operational export matter. It is an extraterritorial jurisdiction with civil penalties of more than $1 million per violation. Its structural consequences (debarment, external monitoring, perpetual contractual clauses) affect the entire business model. A non-U.S. company exposed to the ITAR should treat it as a strategic risk, build it into its overall compliance framework and periodically review the jurisdictional classification of its products.

At Burke Compliance we support non-U.S. companies on three fronts: assessing their ITAR exposure, designing compliance programs integrated with OFAC and the EAR, and managing voluntary disclosure processes with the DDTC. If your company works with technology, data or components with a potential defense nexus, an initial jurisdictional assessment can prevent exposure that would far outweigh the cost of the analysis.

Request an initial ITAR exposure assessment →