Encryption classification under the EAR starts with one test: does the item use cryptography for data confidentiality? If it does, it is classified in Category 5, Part 2 of the Commerce Control List unless a note excludes it. That usually means 5A002 or 5D002, or mass market 5A992.c or 5D992.c once the Cryptography Note releases it. The rules are set out in Encryption export controls: 5A002, 5D002 and 5A992. This FAQ answers the questions exporters actually ask. The general method is in ECCN classification explained.
Scope: when is encryption export controlled?
1. Is encryption really export controlled?
Yes. Items using cryptography for data confidentiality are classified in Category 5, Part 2 of the Commerce Control List, unless excluded or released.
2. My app only uses HTTPS. Does that count?
Generally yes, because it uses encryption. A consumer app with standard HTTPS is usually 5D992.c (mass market) after the Cryptography Note. Classify it; do not assume.
3. Is encryption used only for passwords and logins controlled?
Authentication-only cryptography is generally excluded from 5A002 by its notes, so the item may fall outside Category 5 Part 2 on that basis. Check the notes carefully.
4. What about copy protection or DRM?
Cryptography used for copy protection is generally excluded too. Again, read the notes to 5A002.
Which encryption ECCN applies to software and hardware?
5. What is the difference between 5A002 and 5A992?
5A002 is the controlled entry. 5A992 holds items released from it by the Cryptography Note (mass market). See the mass market release.
6. Is a VPN 5A002?
An enterprise VPN appliance that provides confidentiality is typically 5A002.a. A consumer VPN app sold at retail may be mass market 5D992.c.
7. Our router supports WPA3. What is its ECCN?
A consumer router sold at retail, with cryptography the user cannot change, is typically 5A992.c.
8. Is our encryption library 5D002?
A library that provides cryptographic functionality to other software is often 5D002. If it is publicly available as open source, it may be outside the EAR. See open-source encryption.
9. What about servers with AI accelerators?
Items incorporating chips that meet 3A090 or 4A090 have their own paragraphs, such as 5A992.z, with additional controls.
Licences and filings
10. Do 5A002 items always need a licence?
Not always. Many can be exported under License Exception ENC. See License Exception ENC.
11. Do mass-market items need a filing?
Under § 740.17, some need a classification request, some an annual self-classification report, and some nothing. See what replaced encryption registration, and self-classification vs. a BIS classification request for how the two filings differ.
12. Can we ship encryption anywhere once it is classified?
No. Embargoed destinations, prohibited end uses and restricted parties still apply, so screen every party (see sanctions screening for exporters).
Special cases
13. What about SaaS and the cloud?
Providing a service is generally not an export of software. Downloads, client apps and technology transfers are exports. See cloud computing and encryption.
14. Does storing data encrypted abroad count as an export?
The EAR treats certain end-to-end encrypted technology as not exported, under conditions in § 734.18. Read the conditions before relying on them.
15. Does our manufacturer's classification cover our product?
Only for the product as they sell it. It stops applying once you add or change cryptographic functions. See manufacturers' ECCNs.
A short decision path
- Does it use cryptography for confidentiality? If not, Category 5 Part 2 may not apply.
- Is it excluded by a note? If yes, classify it elsewhere.
- Would it be 5A002 or 5D002? If yes, does the Cryptography Note release it?
- If released, it is 5A992.c or 5D992.c (or .z). If not released, it stays 5A002 or 5D002, and License Exception ENC is worth considering.
- Check which § 740.17 filing applies.
What to have ready before you classify
- the cryptographic functions the product performs (confidentiality, authentication, integrity);
- algorithms and key lengths, and whether the user can change them;
- how the product is sold (retail, app stores, direct enterprise sales);
- how it is installed and configured, and by whom;
- whether it contains advanced computing chips;
- any existing classification request, CCATS or self-classification report.
Mistakes behind most encryption questions
Questions 2, 11 and 15 above come from the most frequent errors: assuming "we just use HTTPS" means no classification is needed, treating every mass-market item as filing-free, and relying on a component supplier's classification for the finished product. Two more come up often. Exporters classify a product as 5A002 without testing the Cryptography Note, and they forget that software updates and SDKs are exports too. For the full walk-through, see encryption export controls explained.
Encryption in ECCN.help
Choose "It uses encryption" when you describe an item in the ECCN.help Classification Workflow. The tool asks the exclusion, Cryptography Note, filing and advanced computing questions in turn and records each answer. It is rule-based, with no AI.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.