When Registration Is Required
Under EAR §742.15(b), exporters of certain encryption items must submit an encryption review request or self-classification report to BIS before using License Exception ENC. This applies to items classified under 5A002, 5D002, 5A992, and 5D992.
The type of submission depends on the classification. Mass-market items (5x992) require a self-classification report. Non-mass-market items (5x002) require a formal classification review with more detailed technical information.
The Filing Process
Self-classification reports are submitted via email to BIS and must include the product name, model numbers, ECCN, a description of the encryption functionality including algorithms and key lengths, and the mass-market classification analysis. Reports must be filed before or concurrent with the first export under ENC.
For formal classification reviews, BIS requires detailed technical documentation including product architecture, encryption implementation details, key management approach, and information about how the product will be used. BIS will respond with a classification determination and ENC authorization within 30 days of receiving a complete submission.
Common Pitfalls
The most frequent error is failing to file at all — many companies are unaware of the requirement or assume their consumer products are exempt. Another common mistake is filing after the first export rather than before, which technically constitutes a violation even if the product would have been approved. Companies that frequently update their encryption products should establish procedures to evaluate whether each update requires a new filing.