EAR — Export Administration Regulations (15 CFR 730–774)

EAR — Export Administration Regulations (15 CFR 730–774)

Issuing body / enforcer: U.S. Department of Commerce, Bureau of Industry and Security (BIS), under the Export Control Reform Act of 2018 (ECRA). Jurisdiction: United States, with broad extraterritorial reach via reexport controls, deemed exports, and the Foreign Direct Product (FDP) rules.

1. What it is

The EAR controls dual-use items — goods, software, and technology with both civilian and military applications — listed on the Commerce Control List (CCL), 15 CFR 774. Every CCL entry carries an Export Control Classification Number (ECCN) in one of ten categories (0–9), with reason-for-control codes (national security, regional stability, anti-terrorism, etc.) that drive license requirements by destination. Unlike ITAR, the EAR includes license exceptions (e.g., ENC, TMP, STA) and a de minimis framework for foreign-made items with U.S. content.

For electronics/embedded and computing engineers, the EAR is the everyday export-control regime: it governs processors, FPGAs, RF components, encryption, and — since 2022 — advanced-computing chips and semiconductor manufacturing equipment.

2. Scope, triggers, thresholds

• CCL / ECCNs: Category 3 (electronics — e.g., 3A001 high-performance electronics, 3A090/3A991 advanced-computing chips), Category 4 (computers — 4A090), Category 5 Part 2 (telecommunications and information security/encryption), Category 9 (aerospace/propulsion).
• Deemed exports: releasing controlled technology or source code to a foreign national in the U.S. is deemed an export to their country of nationality (734.18). This reaches lab work, design reviews, and Git access.
• Deemed reexports: same principle applied to foreign nationals receiving technology abroad.
• End-use controls (744.23): even EAR99 (unlisted) items need a license when destined for military end use in China, Russia, Belarus, Myanmar, Cambodia, Venezuela, or Macau.
• FDP rules: foreign-produced items that are the "direct product" of U.S. technology/software, or produced by plants that are, can be controlled — the mechanism that extends U.S. reach to foreign fabs and equipment (notably the China/Macau advanced-computing FDP rule).
• Encryption (Category 5, Part 2): most mass-market encryption is eligible for License Exception ENC after classification/notification (740.17, 742.15); proprietary or non-standard cryptography is a common enforcement target — [Flag: "common enforcement target" is practitioner consensus, not a BIS-published statistic.]
• License exceptions do not authorize shipments to prohibited end users/uses; screening against BIS's Entity List, MEU List, and Unverified List is mandatory regardless.

3. Key compliance obligations

1. ECCN classification of every product, plus the correct reason-for-control analysis against the Commerce Country Chart (738).
2. License applications via BIS SNAP-R when required; license exceptions (ENC, TMP, RPL, STA) where eligible, with their specific conditions and reporting.
3. End-user/end-use due diligence: "Know Your Customer" guidance, red-flag screening (732, Supplement No. 3), and the Entity List/MEU screening.
4. Encryption reporting: annual self-classification reports and semi-annual sales reports for certain ENC-eligible items (740.17(e), 742.15(b)).
5. Recordkeeping: five years (762).
6. Voluntary self-disclosure to BIS's Office of Export Enforcement — a significant mitigating factor.

4. Penalties and consequences

• Criminal: up to $1,000,000 per violation and 20 years imprisonment, or twice the value of the gain/loss, whichever is greater (ECRA §1760); individuals face the imprisonment term.
• Civil/administrative: up to approximately $370,000 per violation (inflation-adjusted — [Flag: verify current inflation-adjusted figure; the statutory base under ECRA is $300,000, adjusted annually]), plus denial of export privileges.
• Recent enforcement: BIS settled with Applied Materials for a reported $252 million in February 2026, described as its second-largest standalone penalty; Seagate paid $300 million in 2023 for shipping hard drives to Huawei. Enforcement posture on AI/semiconductor supply chains is explicitly elevated — BIS has signaled "high probability" enforcement attention there — [Flag: "high probability" phrasing reflects 2025–2026 BIS public statements as characterized in trade press.]

5. Live changes (verified against current sources, 2026-09-30)

This is the fastest-moving section of U.S. export control. Key developments:

• Advanced-computing controls remain in force: the 2022–2024 controls (ECCNs 3A090, 4A090, related software/technology, §744.23 end-use rules) are fully operative.
• AI Diffusion Rule — rescinded, in regulatory limbo: the January 15, 2025 Interim Final Rule ("Framework for Artificial Intelligence Diffusion") imposed worldwide tiered controls on advanced AI chips and closed-weight model weights above 10²⁶ FLOP, with a May 15, 2025 compliance date. BIS rescinded it on May 13, 2025, two days before enforcement, calling it overly bureaucratic and promising a replacement. As of mid-2026 no replacement rule had been issued; sources describe the rule as unenforced but technically lingering in the CFR — "regulatory purgatory." Practitioners must track this actively; the status can change by rulemaking.
• May 2025 BIS policy guidance (in lieu of the Diffusion Rule): (a) use of Huawei Ascend 910-series chips presumptively violates General Prohibition 10; (b) red-flag due-diligence expectations for advanced-computing items that may train AI models for/in Country Group D:5 destinations (including China) or Macau.
• January 13, 2026 final rule: moved NVIDIA H200- and AMD MI325X-equivalent chip exports to China and Macau from "presumption of denial" to case-by-case review — a material licensing-policy shift.
• April 2025: H20-class chips brought under license requirement (reported $5.5B NVIDIA impact); July 2025: informal reversal reportedly tied to a 15% China-sales revenue remittance arrangement — [Flag: second item reported in trade press; confirm details before citing.]
• Encryption: no 2025–2026 overhaul identified; ENC self-classification/notification mechanics unchanged.

6. Related certifications

No flagship certification in the catalogue tests EAR classification directly; export compliance is counsel/practice-led. Engineers in controlled-technology roles (semiconductors, HPC, encryption products) pair domain credentials — CCNA/CCNP/CCIE for networking hardware, CISSP for encryption-adjacent product security — with employer-run EAR training. Note: BIS's encryption rules specifically reward understanding of License Exception ENC, which product-security engineers should know cold.

7. Practical notes for electronics/embedded and computer engineers

• Classify early: ECCN determination belongs in the design phase for any product with advanced compute, RF/microwave performance near 3A001 thresholds, or non-standard cryptography.
• The deemed-export rule means hiring and lab-access decisions for foreign nationals are export-control decisions. Involve trade compliance before onboarding engineers from D:5 countries onto controlled projects.
• The Diffusion Rule's limbo status does not mean AI-chip exports are uncontrolled — the underlying 3A090/ECCN and end-use controls never went away. Treat "the rule was rescinded" as removing one layer, not the regime.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.