Mass-market encryption items are products that use encryption but are released from 5A002 and 5D002 by the Cryptography Note (Note 3 to Category 5, Part 2 of the Commerce Control List). Under the EAR they are classified in the "mass market" entries 5A992.c and 5D992.c, which are controlled mainly for anti-terrorism reasons. Most encryption products that ordinary people buy, such as phones, laptops, routers and messaging apps, are in this group even though they use strong encryption. This article explains how the note works.
Where the Cryptography Note fits
Encryption classification runs in order. Does the item use cryptography for data confidentiality? Is it excluded by a note to 5A002? Would it be 5A002 or 5D002? If so, does the Cryptography Note release it? The note is relevant only to items that would otherwise be caught. The full sequence is in encryption export controls explained, and the encryption FAQ covers common product types.
What are the four conditions of the Cryptography Note?
An item is released when all of the following are true:
- It is generally available to the public: sold, without restriction, from stock at retail selling points by over-the-counter, mail order, electronic or telephone transactions.
- The user cannot easily change its cryptographic functionality.
- It is designed for installation by the user without further substantial support by the supplier.
- Details are available on request to the authorities of the exporter's country, to confirm the above.
Components and executable software of such items can also be covered, with conditions set out in the note.
What typically qualifies as mass market
- smartphones, tablets and laptops sold at retail;
- consumer Wi-Fi routers and mesh systems;
- off-the-shelf operating systems and office software;
- messaging and consumer VPN apps distributed through app stores;
- consumer storage devices with built-in encryption.
What often does not qualify
- equipment sold only through negotiated enterprise contracts and configured by the vendor;
- network infrastructure with cryptographic functions the customer can customise;
- items whose cryptography the user can change or extend;
- custom or government-specific cryptographic systems.
These stay in 5A002 or 5D002 and are usually exported under License Exception ENC.
Filings for mass-market items
Mass-market status does not always mean no paperwork. Under § 740.17, some mass-market items require a classification request to BIS before export, others can be exported after filing an annual self-classification report, and some need neither. Which applies depends on the item's type and functions. See what replaced encryption registration.
How 5A992.c and 5D992.c are controlled
Mass-market items are controlled mainly for anti-terrorism (AT) reasons, so a licence is required only for a small number of destinations. Embargoes and end-use and end-user controls apply as well. Items with advanced computing chips fall in the .z paragraphs and carry more controls. To see which destinations an AT control reaches, use the Commerce Country Chart.
Worked example: a 5A992.c mesh Wi-Fi system
A consumer mesh Wi-Fi system with WPA3 is sold at electronics retailers and online. The customer configures it through an app, and there is no way to change the cryptography. It would be 5A002.a, but it meets all four conditions, so it is 5A992.c, with the § 740.17 filing position confirmed.
Keeping evidence for each condition
Record how each condition is met and keep the evidence with the classification, together with the filing records. This makes the release easy to defend and easy to re-check when the product, its cryptography or its sales model changes.
| Condition | Evidence to keep |
|---|---|
| Generally available | Retail listings, app store pages, price lists open to the public |
| Not easily changeable | Product documentation showing the cryptographic settings the user can and cannot change |
| User installation | Quick-start guides and support policies showing no substantial supplier involvement |
| Details on request | A named contact and a technical summary ready to provide |
Borderline situations
Some products are sold both at retail and through enterprise contracts. The retail version may qualify while a customised enterprise version does not.
If an administrator can select stronger or custom algorithms, the "not easily changeable" condition needs careful analysis.
Where installation usually needs the vendor, the third condition may fail.
In borderline cases, a classification request to BIS provides certainty. See self-classification vs. a BIS request.
How ECCN.help handles the Cryptography Note
The ECCN.help Classification Workflow asks each Cryptography Note condition as a separate question and records the answers. The router example on that page shows the full path to 5A992.c. It is rule-based, with no AI.
ECCN.help provides research and assistance, not legal advice. Verify every result against the regulation.