Guides to ECCN lookup and classification, EAR99, ITAR vs. EAR jurisdiction, encryption controls, licence requirements and sanctions screening, written for the people who have to get the answer right. New to classifying? Start with how to find the ECCN for your product or see how a classification works in the tool.
Showing guides in Encryption & Cat 5 · All guides
SaaS export regulations under the EAR: a cloud service is generally not an export, but downloads, client apps and data transfers can be. § 734.18 explained.
Open source encryption export: publicly available encryption source code is generally outside the EAR. When BIS notification applies and what stays controlled.
Encryption registration ended in 2016. The annual self-classification report replaced it: what it lists, which items need it, and the 1 February deadline.
License Exception ENC (§ 740.17) lets many 5A002, 5D002 and 5E002 items ship without a licence. The (a), (b)(1), (b)(2) and (b)(3) routes, filings and limits.
Mass-market encryption: how the Cryptography Note releases items from 5A002 and 5D002 to 5A992.c and 5D992.c, its four conditions, examples and filings.
Encryption classification FAQ: when HTTPS, apps, VPNs, libraries and routers fall in 5A002, 5D002 or mass market 5A992.c and 5D992.c, plus ENC and filings.
ECCN.help walks an item through ITAR vs. EAR, the Commerce Control List entry and the paragraph it meets, and shows the rule that decided it. Five classifications are included with every account.