ECCN 5A992.c (also written 5A992c) is the Commerce Control List entry for mass-market encryption hardware: items that would otherwise be 5A002 but are released by the Cryptography Note. The matching software entry is 5D992.c. Encryption items that do not meet the Note stay in 5A002 (hardware), 5D002 (software) or 5E002 (technology) under the Export Administration Regulations (EAR), where they carry national security and encryption controls.
All of these sit in Category 5, Part 2 of the Commerce Control List, headed "information security". Almost every modern product encrypts something, so almost every exporter meets these rules. Three questions decide the classification. Is it controlled as an encryption item at all? Is it 5A002 or 5D002? And does the Cryptography Note release it to mass market 5A992 or 5D992?
Which ECCNs Category 5 Part 2 covers
| ECCN | What it covers |
|---|---|
| 5A002 | Information security systems, equipment and components (hardware) |
| 5A003 and 5A004 | Non-cryptographic information security, and equipment for defeating or weakening information security |
| 5B002 | Test, inspection and production equipment for these items |
| 5D002 | Software for these items, including software that itself encrypts |
| 5E002 | Technology for these items |
| 5A992, 5D992 and 5E992 | The "mass market" entries for items released by the Cryptography Note, and certain other items |
Step 1: Does the item have an information-security function?
The main trigger is cryptography for data confidentiality using a "described security algorithm". The notes to 5A002 exclude many cryptographic uses, for example authentication-only functions and items whose primary function is not information security, computing, communications or networking. An item that only authenticates, or that uses cryptography for copy protection, may fall outside 5A002.
Step 2: Is the item ECCN 5A002 or 5D002?
5A002.a covers items designed or modified to use cryptography for data confidentiality with a described security algorithm, where the cryptographic capability is usable, has been activated or can be activated. Typical examples are network encryptors, VPN appliances and hardware security modules. Their software is 5D002 and their design know-how is 5E002.
The sub-paragraphs of 5A002.a sort items by primary function. 5A002.a.1 is for items whose primary function is information security. 5A002.a.2 is for digital communication or networking systems, equipment and components, and 5A002.a.3 is for computers and other items whose primary function is information storage or processing. Check the full text for the remaining sub-paragraphs.
Step 3: Does the Cryptography Note make it mass market 5A992.c?
Note 3 to Category 5 Part 2, the Cryptography Note, releases items from 5A002 and 5D002 when all of the following are true:
- The item is generally available to the public, sold without restriction from stock at retail by over-the-counter, mail order, electronic or telephone transactions.
- The user cannot easily change its cryptographic functionality.
- It is designed for installation without substantial support from the supplier.
- Details of the item are available to the authorities on request.
Released items are classified 5A992.c (hardware) or 5D992.c (software). A consumer Wi-Fi router with WPA3, or a messaging app with end-to-end encryption, is typically mass market. Each condition is taken in turn in how the Cryptography Note works.
Step 4: Which § 740.17 filing applies?
Encryption is unusual in that some items need a filing even when no licence is required. Under § 740.17 of the EAR, depending on the item:
- some mass-market items and many License Exception ENC items require a classification request to BIS before export;
- others may be exported after the exporter files an annual self-classification report;
- certain items need no filing.
Which applies depends on the item's functions and market, so check § 740.17 for the specific product. See self-classification vs. a BIS request and what replaced encryption registration.
License Exception ENC for 5A002, 5D002 and 5E002 items
Items that stay in 5A002, 5D002 or 5E002 are controlled for national security (NS), anti-terrorism (AT) and encryption items (EI) reasons. Many can still be exported under License Exception ENC (§ 740.17) to most destinations, subject to its conditions and filings. Embargoed destinations and prohibited end users remain off-limits. The paragraphs are set out in License Exception ENC explained.
Advanced computing: the .z paragraphs
Since the advanced computing rules, items that incorporate chips meeting 3A090 or 4A090 have their own paragraphs, such as 5A992.z, with additional regional stability (RS) controls. A mass-market server with qualifying accelerators is 5A992.z.1. It does not go in 5A992.c. Mass-market software has the matching 5D992.z, and items that stay in 5A002 have 5A002.z.
Worked example: a consumer mesh router
Take a consumer mesh Wi-Fi router, sold at retail, with WPA3 encryption the user cannot change and installed by the customer. It uses cryptography for confidentiality (step 1), so it would be 5A002 (step 2). It meets every limb of the Cryptography Note (step 3) and contains no 3A090 chips. It is 5A992.c, with the appropriate § 740.17 filing made or confirmed as not required.
Common encryption classifications at a glance
| Item | Usual ECCN | Comment |
|---|---|---|
| Consumer router, smartphone app or laptop using standard encryption, sold at retail | Usually 5A992.c (hardware) or 5D992.c (software) | After the Cryptography Note |
| Enterprise VPN or network encryptor sold through direct channels and configured for the customer | Often 5A002.a | Exportable to many destinations under License Exception ENC |
| Development tools for encryption products | 5D002.a | Design know-how is 5E002.a |
| Items whose cryptography only authenticates | May fall outside 5A002 | Check the exclusions in the 5A002 notes carefully |
| Mass-market items with advanced computing chips | 5A992.z or 5D992.z | Also controlled for RS |
To read each part of a code like 5A992.c, see ECCN number structure explained.
Questions to answer before classifying an encryption item
- Does it use cryptography for data confidentiality, or only for authentication, integrity or copy protection?
- Which algorithms and key lengths does it implement, and can the user activate or change them?
- How is it sold: at retail to the general public, or through direct negotiated sales?
- Does it need substantial supplier support to install or configure?
- Has the manufacturer made a classification request or a self-classification report under § 740.17?
- Does it incorporate chips that meet 3A090 or 4A090?
With those answers, the path through 5A002, the Cryptography Note and 5A992 is usually clear. If it is not, a classification request to BIS settles it. The encryption classification FAQ covers other common cases.
Encryption in ECCN.help
When you describe an item and choose "It uses encryption", ECCN.help goes to Category 5 Part 2 and suggests the product group. The ECCN.help Classification Workflow then asks the Cryptography Note questions one at a time, followed by the filing question and the advanced computing question, and records each answer. The mesh router example on that page shows the full walk to 5A992.c.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.