Export Administration Regulations (EAR): A Guide on How to Comply

Export Administration Regulations (EAR) are rules and regulations established by the United States Department of Commerce to control and regulate the export of products, technology, and services. The EAR are intended to ensure that items of U.S. origin or containing U.S. origin technology are not exported to certain countries or persons in order to protect national security and foreign policy interests. The EAR also controls potential dual-use items, those items that could provide a benefit to a foreign military or have a potential for use in a weapons of mass destruction program. It is essential to understand the EAR to ensure compliance with export regulations while also avoiding the costly fines and penalties that can be imposed if violations occur. When mapping out a compliance strategy, organizations need to ensure such is reflected in their cybersecurity risk management strategy.

Overview of the EAR

The EAR has jurisdiction over any item located in the U.S. and any item located outside of the U.S. that is controlled by a U.S. person. This includes items produced, manufactured, or developed in the U.S. It also includes those items, regardless of location, that have a U.S. origin and are listed on the Commerce Control List (CCL). The CCL identifies items that are subject to the EAR, such as computers, chemicals, telecommunications equipment, materials for nuclear reactors, and components for use in chemical, biological, or nuclear weapons.

The EAR also imposes licensing requirements on the export of these items. Exporters must obtain licenses from the Department of Commerce in order to export certain items to certain countries, persons, or entities. Licenses may be issued based on the “end-use,” meaning the purpose for which the item will be used, “end-user,” meaning who will receive the item, and “destination,” meaning where the item will be shipped. The Department of Commerce must also be notified of any exports of items subject to the EAR prior to the export with a Shipper’s Export Declaration (SED).

EAR Compliance: Who Needs to Comply?

Export Administration Regulations (EAR) compliance is a mandatory requirement for companies engaged in international trade because it pertains to the export of items or products from the U.S. Companies must comply with the EAR, which are primarily used by the Bureau of Industry and Security (BIS) of the U.S. Department of Commerce to monitor and control the export of sensitive items. The regulations control the items that companies are allowed to export, and they also control the destinations to which they are allowed to be exported.

The purpose of the EAR is to prevent the export of items or technology that may be used for military or terrorist activities. It also prevents the export of items that may be used to threaten U.S. foreign policy. In order to comply with the EAR, companies must review the Commerce Control List (CCL) and the Country Chart in order to determine the type and nature of their items and the countries to which they are exported. They must then obtain the necessary License Documents and perform a classification review of the items in order to determine if they require a license.

All EAR-compliant companies are subject to annual audits and reviews of their compliance with the EAR. They must have a comprehensive compliance program that includes periodic training. The company must also have procedures in place to ensure they are in compliance with the EAR. Finally, they must keep comprehensive records of their activities related to the export of items that are subject to the EAR and provide them to the BIS upon request. Compliance with the EAR is essential for companies involved in international trade, and failure to comply can result in serious penalties or penalties.

EAR vs. ITAR vs. FTR

EAR (Export Administration Regulations) is the Department of Commerce’s regulations that implement the Export Control Reform Act. It governs the export and re-export of controlled items, including software and technology, for commercial and non-commercial purposes. ITAR (International Traffic in Arms Regulations) is the Department of State’s regulations that implement the Arms Export Control Act. It governs the export and re-export of defense-related articles, including military and space-related items that are used for commercial and non-commercial purposes. FTR (Foreign Trade Regulations) is the Department of Commerce’s regulations that implement the Export Administration Act. It governs the export and re-export of dual-use items, including software and technology, for commercial and non-commercial purposes.

EAR License Exceptions

The EAR provides various license exceptions that allow for the export of certain items without a license from the Department of Commerce. These exceptions are generally governed by the EAR and are intended to allow for the export of certain items without an undue burden or risk to national security and foreign policy interests. Common license exceptions include the “short supply” exception, which allows for the export of certain items when there is a shortage of the item in the United States, and the “de minimis” exception, which permits the export of certain items containing a minimal level of U.S.-origin technology. In order to be eligible for a license exception, the exporter must meet the criteria outlined in the relevant section of the EAR.

EAR99 Exemption

EAR99 is a designation given to products in the United States that are subject to export control regulations under the Export Administration Regulations (EAR). The EAR is a set of rules and regulations enforced by the Bureau of Industry and Security (BIS) in the U.S. Department of Commerce. Products designated as EAR99 are generally exempt from export licensing and do not require an exporter to file any export reports.

 

EAR Reforms Over the Years

The EAR has been subject to numerous reforms in recent years in order to better protect the United States’ national security and foreign policy interests. These reforms have included the introduction of new rules and regulations governing the export of items subject to the EAR, such as the requirement that items with encryption capabilities must be licensed prior to export. The reforms have also required businesses to be aware of and comply with new rules surrounding the export of items such as technology subject to the EAR. It is important for businesses to prepare for these reforms by ensuring that they are familiar with the EAR and all relevant licensing requirements.

EAR Fines and Penalties

The Export Administration Regulations (EAR) are important for businesses engaged in international trade to understand to ensure regulatory compliance and avoid fines. In order to comply with the EAR, businesses must understand the license requirements and make sure they are aware of any relevant license exceptions.

Protect Critical Data Sends and Shares Covered by EAR

Protecting confidential information, which falls underneath the EAR, that is digitally shared and sent requires a comprehensive security approach that employs multiple security layers and hardened security. Failure to protect sensitive content communications covered by the EAR can result in serious civil and criminal penalties.

Civil Penalties

The Bureau of Industry and Security (BIS) can impose significant civil penalties for violations of the EAR, including a maximum penalty of $250,000 or twice the value of the illegally exported or reexported items, whichever is greater. BIS may also suspend or deny the export privileges of any company or individual found to have violated the EAR.

Criminal Penalties

It is also a federal crime for anyone to willfully export items in violation of the EAR. Criminal penalties include up to 20 years of imprisonment, large fines, and a mandatory $250,000 forfeiture for each violation. A person convicted of a criminal violation of the EAR may be barred from the export business for life.

Kiteworks Private Content Network and EAR

The Kiteworks Private Content Network (PCN) envelops all of its components in a hardened virtual appliance that includes an embedded network firewall and web application firewall (WAF), zero-trust least-privilege access, and a minimized attack surface. Kiteworks also uses internal layers of protection that reduce the impact on confidentiality, integrity, and availability. This includes artificial intelligence (AI)-based anomaly detection, advanced intrusion detection and alerts, and zero-day threat blocking. These security elements result in lower risk. CVSS vulnerability scores are dramatically reduced due to Kiteworks’ content-based zero-trust approach.

Kiteworks unifies sensitive content communications across different channels—email, file sharing, managed file transfer, web forms, and APIs—in one platform. One outcome is that Kiteworks can track and control audit trails across each communication channel and generate reports used to demonstrate compliance with regulations such as the EAR.

Learn more about Kiteworks and how you can use it to demonstrate compliance for regulations such as the EAR when sending, sharing, receiving, and storing sensitive content communications by scheduling a custom demo.

 

Back to Risk & Compliance Glossary