To find the ECCN for software under the EAR, look in product group D ("Software") of the Commerce Control List category that covers what the software does or the item it was written for. If the software is subject to the EAR and no entry describes it, it is EAR99. Two checks come before that search: whether the software is subject to the EAR at all, since published software generally is not, and whether it has encryption or other information security functions, which have to be checked against Category 5, Part 2 even when they are only one feature of a larger product.
The method is the one in our guide on how to find the ECCN for a product. For software, the entries turn on what the code is "specially designed" for, which activity it supports, and sometimes whether you hand over source code.
Is your software subject to the EAR?
Under § 734.3(a), all items in the United States and all U.S.-origin items wherever located are subject to the EAR, and so is foreign-made software commingled with controlled U.S.-origin software above the de minimis levels in § 734.4. A software company outside the United States therefore asks where the code was written and whether it contains controlled U.S.-origin code. In narrower cases there is a third question: whether the software is the direct product of certain U.S. technology or software under the foreign direct product rules in § 734.9.
Section 734.3(b)(3) takes some software out of the EAR altogether, including software that is published (§ 734.7) or that arises during or results from fundamental research (§ 734.8). Under § 734.7(a), unclassified software is published when it has been made available to the public without restrictions upon its further dissemination, for example on internet sites available to the public. Our guide to published information and fundamental research covers these exclusions.
Two kinds of published software stay inside the EAR. Published encryption software classified under 5D002 remains subject unless § 742.15(b) takes it out. Under that paragraph, publicly available encryption source code is not subject to the EAR (if it performs "non-standard cryptography", BIS and the ENC Encryption Request Coordinator must be notified), and neither is publicly available object code whose corresponding source code meets it (see open source encryption and the EAR). Under § 734.7(c), files posted on the internet for producing firearms, frames or receivers controlled under 0A501, 0A506, 0A507 or 0A509, ready to run on CNC or additive manufacturing equipment, also remain subject.
Commercial software sold under a licence agreement that limits copying and redistribution sits badly with the "without restrictions upon its further dissemination" wording. ECCN.help's suggestion is to classify proprietary products and keep the published exclusion for code that anyone can obtain and pass on.
Then check jurisdiction. Supplement No. 4 to Part 774 says that an item described on the U.S. Munitions List is subject to the ITAR, with no need to review the CCL. The Related Controls note to 0D602, for example, says that software required for and directly related to articles enumerated in USML Category II is subject to the ITAR. If your software supports defence articles, settle ITAR or EAR first.
Where to look for an ECCN for software: product group D
Section 738.2(b) gives every CCL category the same five groups, and group D is software. The letter after the first digit names the group, so 3D001 and 5D992 are software entries while 3A001 is equipment (see CCL product groups A–E). Software entries in the Commerce Control List follow a few patterns, and the pattern tells you which facts you need.
| Pattern | Examples | What decides it |
|---|---|---|
| Software for a controlled commodity | 3D001 (for the "development" or "production" of commodities in 3A001.b to 3A002.h, 3A090 or most of 3B); 6D001 | The item the software is for, that item's ECCN, and the activity supported |
| Software defined by its own functions | 5D002.c.1 (performing or simulating the functions of certain 5A002 equipment); 4D004 (generation, command and control, or delivery of "intrusion software") | What the software does, against the entry's parameters |
| Source code entries | 7D002 (source code for the operation or maintenance of any inertial navigation equipment or AHRS); 7D004 | Whether you deliver source code or object code only |
| "600 series" military software | 9D610 (for military aircraft and related items in 9A610, 9B610 or 9C610) | Whether it is "specially designed" for a 600 series item |
| Anti-terrorism (AT) only entries | 3D991; 7D994 ("software", n.e.s., for navigation, airborne communication and other avionics) | The same questions; the licence result turns on the AT column of the Country Chart |
A 600 series or 9x515 entry takes precedence over any other ECCN that also describes the item (step 3 of Supplement No. 4 to Part 774). Separately, 0D521 holds software listed in Supplement No. 5 to Part 774 under temporary control while the U.S. Government decides whether a new or revised ECCN, or EAR99, is appropriate (§ 734.3(c) and § 742.6(a)(8)).
The activity words are defined in § 772.1: "development" is all stages before serial production, "production" is all production stages, and "use" is operation, installation, maintenance (checking), repair, overhaul and refurbishing. 3D001 covers software for development or production, while 3D002 covers software for the "use" of equipment in 3B001.a to .f or 3B002, so a program that operates a machine and a program used to design it can land in different entries.
How "specially designed" works for software
Most D entries use "specially designed", defined in § 772.1. Paragraph (a)(2) catches any "software" for use in or with a commodity or defence article that is enumerated or otherwise described on the CCL or the USML. Paragraph (b) then releases software that would otherwise be caught, for example where:
- it has the same function, performance capabilities and the same or equivalent form and fit as software used with an item in production that is not enumerated on the CCL or USML or is in an AT-only ECCN (paragraph (b)(3));
- it was developed as general purpose software, with no knowledge that it would be used with a particular commodity or type of commodity (paragraph (b)(5)); or
- it was developed with knowledge that it would be used with items in an AT-only ECCN and also EAR99 items, or exclusively with EAR99 items (paragraph (b)(6)).
For software, Note 3 to paragraph (b)(3) defines "form" as the design, logic flow and algorithms, and "fit" as the ability to interface or connect with an item subject to the EAR. A release under (b)(4), (b)(5) or (b)(6) needs documents made at the time of development, such as concept design information, marketing plans, declarations in patent applications or contracts. Our guide to "specially designed" in § 772.1 walks through the full catch and release.
A worked example
Take a hypothetical U.S. company that makes a wafer prober it has classified under 3B992.b.3.b (stored program controlled wafer probing equipment capable of testing devices having more than 68 terminals), an AT-only entry. Its engineers write a desktop application that operates that prober and nothing else. The application is software for the "use" of a commodity described on the CCL, so paragraph (a)(2) catches it. On these facts no release fits. The application is not general purpose, so (b)(5) is out, and (b)(6) needs EAR99 items in the design brief as well. Assume also that no equivalent software is in production for an EAR99 item or another AT-only item, which (b)(3) would need. ECCN 3D991 covers software "specially designed" for the "use" of 3B992 equipment, so the application is 3D991.
Change one fact. Suppose design documents show the application was written from the start to run both the prober and the company's EAR99 bench multimeters. Paragraph (b)(6) now releases it, 3D991 drops away, and the review continues through the CCL. If nothing else describes it and it has no information security functions controlled in Category 5, Part 2, it is EAR99. Without those contemporaneous documents, the first answer stands.
Encryption and other information security functions
The General "Information Security" Note in Supplement No. 2 to Part 774 says information security items or functions should be considered against Category 5, Part 2, even if they are components, software or functions of other items. So any software that uses cryptography has to be checked against that part of the CCL. Software that meets its controls is 5D002; mass market encryption software classified in accordance with § 740.17(b) is released from the NS and EI controls and designated 5D992.c, an AT-controlled entry. Our guide to 5A002, 5D002 and 5D992.c covers that analysis, and the one on SaaS export regulations and cloud encryption deals with software that customers only reach as a hosted service.
When is software EAR99?
Software subject to the EAR that no ECCN describes is designated EAR99 (§ 734.3(c) and step 6 of Supplement No. 4 to Part 774). You get there by ruling entries out, as our guide on what EAR99 means explains, so record each entry you checked.
EAR99 software can still need a licence for a prohibited or restricted end user, end use or destination, as step 6 warns. For example, § 746.8(a)(8) requires a licence to export, reexport or transfer listed types of software to or within Russia or Belarus, among them ERP, CRM, CAD and CNC machine tool software, and their updates. BIS's FAQ EAR99 Software Controls dates that requirement to 16 September 2024 and explains its exclusions.
Does the General Software Note make software EAR99?
No. The General Software Note in Supplement No. 2 to Part 774 leaves the software's ECCN in place and makes License Exception TSU (§ 740.13(d)) available, to all destinations except Country Group E:1, for software sold from stock at retail selling points without restriction and designed for installation by the user without further substantial support from the supplier. It does not apply to software controlled by Category 5, Part 2, and § 740.13(d)(2) also excludes software controlled for missile technology (MT) reasons. Part 746 narrows it further for some destinations: for Russia and Belarus, § 746.8(c)(2) lets TSU overcome the Part 746 licence requirements only for software updates to certain civil end users. See our guide to License Exception TSU.
Source code, object code, updates and licence keys
Section 772.1 defines source code as a convenient expression of one or more processes that a programming system can turn into equipment executable form, which is object code. Most D entries do not distinguish between them, but 7D002 and 7D004 control source code only. The difference also counts for releases: under § 734.13(a)(2), releasing source code (but not object code) to a foreign person in the United States is a deemed export, to that person's most recent country of citizenship or permanent residency (§ 734.13(b)).
Updates need their own look. TSU (§ 740.13(c)) covers updates limited to correcting errors in lawfully exported software, sent to the same consignee, that do not add to the functional capacities of the original. A release that adds features falls outside paragraph (c), so check whether the new features change the classification. Note 2 to § 734.19(b), written for software keys, says the same thing: changes to, or the addition of, features may affect classification.
Section 734.19(b), added by a rule published on 5 December 2024 (89 FR 96790), covers software keys that let a user operate software or hardware or renew a use licence. The key takes the same ECCN as the item it gives access to and needs the same level of authorisation. If no licence was needed at first but a requirement is imposed later, for example because the customer is added to the Entity List, later exports of the software or hardware and of the key fall under the new requirement. Keys that unlock dormant functionality are outside paragraph (b).
What to do before you assign the ECCN
- Confirm the software is subject to the EAR: check the published and fundamental research exclusions and the USML.
- List every function the software performs, including any cryptography, and every item it is written for, with that item's ECCN.
- Work any information security function through Category 5, Part 2.
- Read the D entries in the categories those items and functions point to, and apply the "specially designed" catch and release using your development records.
- Record the ECCN or EAR99 conclusion with the entries you ruled out, and look again when a release adds features.
Classifying software in ECCN.help
ECCN.help applies rules taken from the published EAR, with no language model, so the same description gets the same answer and each answer names the entry and paragraph that decided it. The classification workflow checks ITAR or EAR jurisdiction first, then walks the software to a CCL entry, asks only for the parameters that entry turns on, and records each entry it rules out on the way to EAR99. Describe the software in ordinary terms, such as what it does and what it runs with, and never enter source code or controlled technical data.
ECCN.help provides research and assistance, not legal advice. Verify every result against the current regulation before you rely on it.