The Licence You Need Before Emailing a Drawing Abroad
Export control law restricts moving controlled technology across borders, and sending a file to a foreign colleague can count as an export. Compliance is a permanent operating cost for anybody building regulated technology.
What Is Being Controlled
Export controls restrict the transfer of specified goods, software, and technical data to particular destinations, end users, and end uses.
The American system runs on two principal regimes. The International Traffic in Arms Regulations govern defence articles and services listed on a munitions list, administered by the State Department. The Export Administration Regulations govern dual use items, meaning things with both civil and military application, administered by the Commerce Department.
Classification determines everything that follows, and getting it wrong is the most common serious compliance failure.
The Concept That Catches People
The rules control technical data as well as physical items, and they define export unusually broadly.
A deemed export occurs when controlled technology is released to a foreign national inside the exporting country. Showing a controlled drawing to a colleague on a work visa is treated as an export to that person country of nationality, and may require a licence.
| Action | Treated As |
|---|---|
| Shipping hardware abroad | Export |
| Emailing a controlled drawing overseas | Export |
| Showing controlled data to a foreign national at home | Deemed export |
| Uploading to a cloud server abroad | Potentially an export |
The most consequential provision in the whole regime is that a conversation in your own office can be an export. Hiring, laboratory access, and document permissions all become compliance decisions rather than administrative ones.
What That Means Operationally
The deemed export rule reshapes ordinary business processes in ways that are invisible from outside.
Hiring. A role requiring access to controlled technology may require a licence for a candidate of certain nationalities, which takes months. Companies frequently manage this by segregating projects rather than by restricting hiring, and doing the latter badly creates discrimination exposure under employment law, which is a genuine tension the rules do not resolve.
Information systems. Access controls must operate by nationality as well as by role, and data must not be stored where unauthorised persons could reach it. Cloud services present a specific difficulty, since data residency and administrator access both matter.
Visitors and conferences. Site visits, presentations, and technical discussions require screening.
The Exemptions That Do Most of the Work
Two carve outs prevent the regime from covering essentially all technical activity.
Fundamental research conducted at accredited institutions, where results are intended for publication and are not restricted, is generally not subject to control. That exemption is what permits open academic research on subjects that would otherwise be controlled.
It is also fragile. Accepting a contract clause giving a sponsor the right to review or restrict publication, or restricting who may participate, removes the exemption for that project. University research offices spend substantial effort on exactly that point, because a well intentioned confidentiality clause can convert an open project into a controlled one.
Published information already in the public domain is not controlled, which is why the classification question is about what has not been published.
Screening Obligations
Beyond item classification, the regime imposes obligations concerning counterparties.
Restricted party screening checks customers, suppliers, and partners against lists of denied and sanctioned parties, which must be done for each transaction rather than once.
End use and end user checks require attention to red flags suggesting a transaction may be diverted, including a customer whose business does not match the item, reluctance to provide end use information, or shipping arrangements inconsistent with the stated destination.
The concept that the rules apply notwithstanding an absence of actual knowledge, where a party is aware of a high probability, means deliberate ignorance is not a defence.
The Extraterritorial Reach
A feature that surprises non American companies is how far the rules extend.
Items manufactured abroad can be subject to American control if they incorporate more than a threshold percentage of American origin content, or if they are the direct product of American origin technology.
The foreign direct product rule has been extended to cover items produced abroad using American origin software or equipment, which brought a substantial share of global semiconductor manufacturing within scope regardless of where it occurs.
That extension is the mechanism through which export controls became an instrument of technology policy rather than only of defence trade.
The Cost of Getting It Wrong
Penalties include substantial civil fines per violation, criminal liability for wilful conduct, and denial of export privileges, which for a technology company is effectively a prohibition on operating.
Voluntary self disclosure of a violation substantially mitigates penalties and is the standard advice, which produces the uncomfortable situation where discovering a problem creates an obligation to report it.
The Bottom Line
Export controls restrict moving technology across borders, and the definition of both technology and border is broader than intuition suggests. Emailing a file, hiring an engineer, and choosing a cloud region are all export decisions where controlled data is involved, and the fundamental research exemption that protects open science evaporates on a single restrictive contract clause. The extraterritorial reach through the foreign direct product rule is what turned a defence trade regime into a lever over global technology supply chains.