Export Control Checklist: Jurisdiction, Classification, Deemed Export Screening, Licenses, and Recordkeeping

By Casey Scott McKay · 2025-10-05

This checklist runs the export control questions a technology company has to answer, in the order they arise. It begins with jurisdiction and classification, because every downstream requirement depends on them, and it marks the documentation that makes a classification defensible. It then works the exclusions that take most technical work outside the controls, the foreign person access mapping that identifies real deemed export exposure, and the licensing route that avoids creating an immigration discrimination problem. It covers restricted party and sanctions screening including the ownership rule, geolocation controls for online services, licence exception documentation, recordkeeping, audit, and the disclosure decision. It closes with the patent-side foreign filing licence workflow and the transactional interactions.

IP and Technology > IP and IT in Corporate Transactions | Checklist | Published 5 October 2025 - Updated 12 July 2026 | Casey Scott McKay - marksy.us

Summary. This checklist runs the export control questions a technology company has to answer, in the order they arise. It begins with jurisdiction and classification, because every downstream requirement depends on them, and it marks the documentation that makes a classification defensible. It then works the exclusions that take most technical work outside the controls, the foreign person access mapping that identifies real deemed export exposure, and the licensing route that avoids creating an immigration discrimination problem. It covers restricted party and sanctions screening including the ownership rule, geolocation controls for online services, licence exception documentation, recordkeeping, audit, and the disclosure decision. It closes with the patent-side foreign filing licence workflow and the transactional interactions.

Keywords: export control checklist · jurisdiction determination · commodity jurisdiction · ECCN classification · EAR99 · encryption reporting · published information · fundamental research · deemed export · foreign person access · repository segmentation · restricted party screening · ownership rule · geolocation controls · license exceptions · recordkeeping · internal audit · voluntary self disclosure · foreign filing license · CFIUS critical technology

How to use this checklist

| Phase | What it covers | |---|---| | 1 | Governance | | 2 | Jurisdiction | | 3 | Classification | | 4 | Encryption | | 5 | Exclusions | | 6 | Foreign person access | | 7 | Deemed export licensing | | 8 | Hiring and immigration | | 9 | Restricted party screening | | 10 | Sanctions and geolocation | | 11 | Licence exceptions | | 12 | Licences and authorisations | | 13 | Contracts | | 14 | Foreign filing licences | | 15 | Secrecy orders | | 16 | Transactions and CFIUS | | 17 | Recordkeeping | | 18 | Audit | | 19 | Incidents and disclosure | | 20 | Training and cadence |

Boxes marked [Gate] must clear before access is granted, a transfer is made, a foreign filing is instructed, or a transaction closes.

The matter. A software company with no shipping department, no hardware, and no idea it was an exporter. The classification exercise took three weeks, narrowed the controlled set to two repositories, and found four people whose access required authorisation, one reseller owned by a listed entity, and two patent applications filed abroad without a licence.

Phase 1. Governance

[ ] Name an accountable owner with authority to stop a hire, a grant, or a shipment.
- Why. Enforcement authorities look for senior management commitment, and a programme with no stop authority has no controls.
- Trap. A compliance function that can advise but not block.
[ ] Write the technology control plan.
- Why. It is the operative document: classifications, access rules, authorisation process, and records.
- Trap. A plan describing products discontinued two years ago.
[ ] Set the escalation route.
- Why. Front-line staff need to know what to stop and whom to call.
- Trap. Escalation to a committee that meets monthly.

Phase 2. Jurisdiction

[ ] [Gate] Determine whether anything is on the United States Munitions List.
- Why. 22 C.F.R. § 121.1 governs, and ITAR is a materially stricter regime.
- Trap. Assuming commercial sales mean commercial classification; the item's characteristics govern.
[ ] File a commodity jurisdiction request where uncertain.
- Why. It produces a determination rather than an assumption.
- Trap. Proceeding on an assumption for defence-adjacent technology.
[ ] Confirm ITAR registration where applicable.
- Why. 22 C.F.R. § 122.1 requires registration by manufacturers and exporters regardless of whether anything is exported, and it renews annually.
- Trap. A manufacturer that has never exported and never registered.
[ ] Otherwise confirm the item is subject to the EAR.
- Why. 15 C.F.R. § 734.3 defines the scope, including the catch-all.
- Trap. Concluding an item is unregulated because no ECCN applies.

Phase 3. Classification

[ ] [Gate] Assign an ECCN or EAR99 to every product, technology, and software component.
- Why. 15 C.F.R. § 774.1 sets the Commerce Control List, and every downstream requirement depends on the classification.
- Trap. Classifying products but not the technology required for their development, production, or use.
[ ] Record the reasoning, the date, and the person.
- Why. A conclusion without reasoning is not defensible in an audit or a disclosure.
- Trap. A spreadsheet of ECCNs with no supporting analysis.
[ ] Use a classification request where the answer matters.
- Why. 15 C.F.R. § 748.3 produces an official determination.
- Trap. Self-classifying a borderline item and building the whole programme on it.
[ ] Do not treat EAR99 as uncontrolled.
- Why. Embargoed destinations, listed parties, and prohibited end uses reach EAR99 items.
- Trap. "EAR99, so we can ship anywhere."
[ ] Re-classify on capability change.
- Why. Adding a feature can move the ECCN.
- Trap. Classification treated as a one-time exercise.

Phase 4. Encryption

[ ] [Gate] Determine whether the product implements or uses cryptographic functionality.
- Why. 15 C.F.R. § 742.15 governs, and nearly every modern software product implicates it.
- Trap. Assuming that using a third-party library removes the obligation.
[ ] Determine whether self-classification or a classification request applies.
- Why. The route depends on the functionality and the intended classification.
- Trap. Self-classifying where a request is required.
[ ] Complete the reporting and diary the annual cycle.
- Why. Reporting obligations recur.
- Trap. A one-time submission and no calendar entry.
[ ] Handle open source encryption source code separately.
- Why. Publishing encryption source code carries notification obligations distinct from the classification itself.
- Trap. A repository made public with no notification.

Phase 5. Exclusions

[ ] [Gate] Apply the published information exclusion honestly.
- Why. 15 C.F.R. § 734.7 takes published and generally accessible information outside the EAR, and this usually shrinks the controlled set substantially.
- Trap. Treating internal documentation as published because it is widely circulated internally.
[ ] Assess fundamental research correctly.
- Why. 15 C.F.R. § 734.8 is an institutional exclusion for research at accredited US institutions where results are ordinarily published.
- Trap. Applying it to corporate research, or losing it because the sponsored research agreement restricts publication or participation.
[ ] Check the patent provisions.
- Why. 15 C.F.R. § 734.10 addresses patents and published applications.
- Trap. Assuming a pending unpublished application is published information; it is not.
[ ] Record which materials are excluded and why.
- Why. The exclusion analysis is as important to document as the classification.
- Trap. An undocumented conclusion that most material is outside the controls.
[ ] Note that ITAR exclusions are narrower.
- Why. The public domain concept under the ITAR is not the EAR's published information exclusion.
- Trap. Applying EAR reasoning to ITAR technical data.

Phase 6. Foreign person access

[ ] [Gate] Map every repository and its classification.
- Why. Access to controlled technology by a foreign person is a deemed export under 15 C.F.R. § 734.13.
- Trap. A permissions group functioning as an export mechanism nobody authorised.
[ ] Map access by person, status, and country.
- Why. The requirement depends on the ECCN and the person's country of nationality.
- Trap. Assuming visa holders are US persons.
[ ] Cover the non-repository channels.
- Why. Meetings, support calls, contractor onboarding, visitor tours, conference material, laptops abroad, and cloud administrator access are all release mechanisms under 15 C.F.R. § 734.15.
- Trap. A programme that controls code and ignores conversations.
[ ] Segment where segmentation is cheaper than licensing.
- Why. Narrowing the controlled repository to a small group frequently eliminates the requirement entirely.
- Trap. Applying for broad licences instead of restructuring access.
[ ] Recertify access quarterly against the classification map.
- Why. Access accretes.
- Trap. Grants that outlive the project.

Phase 7. Deemed export licensing

[ ] [Gate] Determine the actual requirement per person, technology, and country.
- Why. For many combinations no licence is required, and determining this is what makes the programme proportionate.
- Trap. Assuming any foreign national access requires a licence.
[ ] Apply where required, naming the person, employer, technology, and scope.
- Why. Deemed export licences are person-specific and technology-specific.
- Trap. Treating a licence as covering a team.
[ ] Restrict access pending approval rather than delaying the hire.
- Why. Onboarding on non-controlled work is lawful and is the correct answer.
- Trap. A withdrawn offer, which creates an immigration exposure.
[ ] Track scope changes and expiry.
- Why. A role change or new technology may exceed the licence.
- Trap. A licensed engineer moved to a different controlled project.
[ ] Apply the stricter ITAR analysis where applicable.
- Why. 22 C.F.R. § 125.4 exemptions are narrow.
- Trap. EAR reasoning applied to USML technical data.

Phase 8. Hiring and immigration

[ ] [Gate] Do not impose citizenship or national origin requirements as an export control.
- Why. 8 U.S.C. § 1324b prohibits citizenship status and national origin discrimination, and enforcement against employers who imposed blanket requirements is substantial.
- Trap. "US persons only" in a job posting for a role that touches no controlled technology.
[ ] Complete the I-129 export control certification accurately.
- Why. It certifies whether a deemed export licence is required before the worker accesses controlled technology.
- Trap. Certifying without having done the classification analysis.
[ ] Collect foreign person status at onboarding, not at access request.
- Why. Access decisions need the information already available.
- Trap. Ad hoc questions that look like screening by nationality.
[ ] Train human resources and immigration counsel together.
- Why. These areas are frequently advised in isolation, which is how a discrimination problem gets created to solve an export problem.
- Trap. Two correct pieces of advice producing an incorrect practice.

Phase 9. Restricted party screening

[ ] [Gate] Screen every counterparty at engagement.
- Why. 15 C.F.R. § 744.11 and the associated end-user provisions impose licence requirements for listed parties.
- Trap. Screening customers and not contractors, suppliers, or resellers.
[ ] Apply the fifty percent ownership rule.
- Why. Entities owned fifty percent or more in the aggregate by blocked persons are themselves blocked without being named.
- Trap. Name-only screening, which misses them entirely.
[ ] Rescreen the active book periodically.
- Why. Lists change frequently.
- Trap. A counterparty clear at onboarding and listed six months later.
[ ] Screen for prohibited end uses, not only parties.
- Why. The end-use provisions reach EAR99 items where weapons or certain military end uses are involved.
- Trap. Concluding no licence is needed from the classification alone.
[ ] Train on red flags and document the response.
- Why. Obligations attach where a party knows or has reason to know, and wilful blindness is not a defence.
- Trap. A sales representative resolving a hit informally.
[ ] Keep the screening record.
- Why. Screening that leaves no record cannot be proved.
- Trap. A screening tool with no export of results.

Phase 10. Sanctions and geolocation

[ ] [Gate] Deploy geolocation and address screening on any online service.
- Why. Its absence is the most common finding in modern sanctions enforcement against technology companies.
- Trap. A signup flow with no country validation.
[ ] Screen payment instruments and billing addresses.
- Why. They frequently reveal what IP addresses do not.
- Trap. VPN-masked access treated as sufficient defence.
[ ] Understand strict liability.
- Why. Civil liability under sanctions programmes does not require intent, and penalties are per transaction.
- Trap. Assuming good faith is a defence.
[ ] Address facilitation.
- Why. US persons may not approve, finance, or facilitate transactions by foreign persons that would be prohibited if performed by a US person.
- Trap. US-based staff supporting a non-US affiliate's prohibited transaction.
[ ] Build the blocking and reporting process before it is needed.
- Why. Blocked property must be blocked and reported within defined windows.
- Trap. Discovering the obligation after the deadline.
[ ] Check embargoed destinations under both regimes.
- Why. 22 C.F.R. § 126.1 and the OFAC programmes operate on different bases.
- Trap. A transaction clear under the EAR and prohibited under sanctions.

Phase 11. Licence exceptions

[ ] Identify the exception before relying on it.
- Why. Exceptions cover temporary exports, limited value shipments, technology for operation and maintenance, encryption, and intra-company transfers, each with conditions.
- Trap. Relying on an exception by name without reading its eligibility requirements.
[ ] [Gate] Verify every condition is met.
- Why. Using an exception without meeting its conditions is a violation.
- Trap. Destination restrictions overlooked.
[ ] Document the reliance contemporaneously.
- Why. In an audit, an undocumented exception is indistinguishable from an unlicensed export.
- Trap. Reconstructing the analysis a year later.
[ ] Track any reporting obligations attached to the exception.
- Why. Several carry them.
- Trap. Reporting missed because nobody diarised it.

Phase 12. Licences and authorisations

[ ] Apply with complete information.
- Why. 15 C.F.R. § 748.3 and the associated provisions require the item, parties, end use, and supporting documentation.
- Trap. Incomplete applications that return for supplementation and lose months.
[ ] Read and comply with conditions and provisos.
- Why. Compliance with the conditions is part of compliance with the licence.
- Trap. A reporting proviso nobody read.
[ ] [Gate] Diary expiry and renewal.
- Why. A programme that obtains licences and does not track expiry will operate unlicensed.
- Trap. Continuing transfers under an expired authorisation.
[ ] Treat ITAR agreements as ongoing obligations.
- Why. Technical assistance and manufacturing licence agreements under 22 C.F.R. § 124.1 contain mandatory clauses including on retransfer and reporting.
- Trap. Filing the agreement and never revisiting its terms.

Phase 13. Contracts

[ ] Include export compliance covenants in customer and reseller agreements.
- Why. 15 C.F.R. § 734.14 makes reexports subject to the EAR, and the covenant is the contractual hook.
- Trap. A distribution agreement silent on reexport.
[ ] Include termination rights on listing or designation.
- Why. A counterparty listed mid-contract must be stopped immediately.
- Trap. A contract that requires notice and cure before termination.
[ ] Address technology licences as exports.
- Why. A licence to a foreign licensee is a transfer of technology.
- Trap. Treating the licence as a purely commercial document.
[ ] [Gate] Review sponsored research agreements for publication and participation restrictions.
- Why. They destroy the fundamental research exclusion at 15 C.F.R. § 734.8 for the whole project.
- Trap. A sponsor's standard clause accepted without analysis.
[ ] Address cloud administrator location and encryption in hosting agreements.
- Why. Administrator access is a potential release.
- Trap. No notification obligation on changes in data location.
[ ] Include foreign person status and access provisions in contractor agreements.
- Why. Contractors are the least-controlled access channel in most companies.
- Trap. Onboarding a contractor with repository access before any status question is asked.

Phase 14. Foreign filing licences

[ ] [Gate] Read the filing receipt for every US application.
- Why. The foreign filing licence under 35 U.S.C. § 184 usually issues automatically and appears there.
- Trap. Assuming rather than checking, which is how the failures happen.
[ ] Docket the six-month date.
- Why. Foreign filing is permitted six months after a US filing where no secrecy order has issued.
- Trap. A foreign filing instruction sent at month four with no licence on file.
[ ] Gate foreign filing instructions on a licence confirmation or clearance.
- Why. A docketing gate is the only reliable control.
- Trap. Instructions sent by an attorney working from memory.
[ ] Petition where a licence is needed sooner.
- Why. 37 C.F.R. § 5.12 provides the route, with expedited handling available.
- Trap. Missing a Paris Convention deadline while waiting.
[ ] Check new matter added abroad.
- Why. The licence covers the subject matter of the US application.
- Trap. A foreign filing incorporating developments made after the US filing.
[ ] Apply the test correctly: where was the invention made?
- Why. The trigger is the place of invention, not the inventor's nationality or the applicant's domicile.
- Trap. A US research site of a foreign parent, filing first at home.
[ ] [Gate] Seek a retroactive licence immediately on discovering an unlicensed filing.
- Why. 37 C.F.R. § 5.25 provides the cure; 35 U.S.C. § 185 provides invalidity if it is not obtained.
- Trap. Discovering the problem during an assertion, when the adversary raises it.
[ ] Audit an existing portfolio once.
- Why. Historic filings made without discipline are curable now and not later.
- Trap. Assuming the outside firm handled it.

Phase 15. Secrecy orders

[ ] Anticipate them for defence-adjacent subject matter.
- Why. 35 U.S.C. § 181 permits imposition where publication would be detrimental to national security.
- Trap. A filing programme with no contingency for a secrecy order.
[ ] Comply strictly while in force.
- Why. Issue is withheld, foreign filing is barred, and disclosure is restricted.
- Trap. Continuing a collaboration that discloses the subject matter.
[ ] Consider the compensation route.
- Why. 35 U.S.C. § 183 provides for compensation for damage caused by the order.
- Trap. Treating the order as purely a loss.
[ ] Diary the review and renewal cycle.
- Why. Orders are reviewed periodically and may be rescinded.
- Trap. An order rescinded years earlier with the application still sitting.

Phase 16. Transactions and CFIUS

[ ] [Gate] Structure technical diligence before the data room opens.
- Why. Disclosure to a foreign acquirer's personnel is a release.
- Trap. Full technical access granted in week one of diligence.
[ ] Diligence the target's export position.
- Why. Successor liability is real, penalties are per violation, and denial of export privileges can eliminate the deal rationale.
- Trap. An IP diligence checklist with no export section.
[ ] Run the CFIUS analysis from the classification.
- Why. 50 U.S.C. § 4565 defines critical technology by reference to export classifications, and mandatory filings attach to certain transactions.
- Trap. A wrong classification producing a missed mandatory filing with its own penalty regime.
[ ] Include representations, covenants, and a special indemnity.
- Why. The exposure is quantifiable per violation and diligence rarely finds everything.
- Trap. Export folded into a general compliance representation with a low cap.
[ ] Include an export review in the integration plan.
- Why. New access grants, merged repositories, and shared teams at closing are all release events.
- Trap. Permissions merged on day one.
[ ] Prepare sell-side.
- Why. Documented classifications, a clean access map, and complete records speed diligence and support price.
- Trap. Assembling the file under deal pressure.

Phase 17. Recordkeeping

[ ] [Gate] Know what must be kept.
- Why. 15 C.F.R. § 762.2 sets the categories, and sanctions programmes impose parallel obligations.
- Trap. Retaining shipping documents and discarding classification analyses.
[ ] Keep classification rationales, screening results, licence records, and exception documentation.
- Why. These are the defence file in any enforcement matter.
- Trap. Records held in individual mailboxes.
[ ] Make them retrievable.
- Why. A retention obligation satisfied by an unsearchable archive is not satisfied in practice.
- Trap. An archive nobody can query under a disclosure deadline.
[ ] Set the retention period to the longest applicable and apply it consistently.
- Why. Multiple regimes with different periods.
- Trap. Deleting on the shortest schedule.

Phase 18. Audit

[ ] Audit annually against the technology control plan.
- Why. It is the only way to know whether the programme operates as documented.
- Trap. An audit of the policy rather than the practice.
[ ] Sample classifications for reasoning and currency.
- Why. Stale and unreasoned classifications are the most common finding.
- Trap. Checking that a classification exists rather than that it is right.
[ ] Sample access grants against the classification map.
- Why. Access accretes between recertifications.
- Trap. Reviewing the process and not the current permissions.
[ ] Test the geolocation controls.
- Why. Controls degrade silently after platform changes.
- Trap. Assuming a control deployed two years ago still functions.
[ ] Run a mock disclosure.
- Why. Assembling what a disclosure would require finds the real gaps.
- Trap. Discovering the gaps during an actual disclosure.
[ ] Track findings to closure with owners and dates.
- Why. Remediation is scored in any enforcement outcome.
- Trap. Findings recorded and never closed.

Phase 19. Incidents and disclosure

[ ] [Gate] Contain and preserve first.
- Why. Stop the conduct, suspend access, preserve records — the records are both the investigation and the defence.
- Trap. Deleting the accounts before recording what they did.
[ ] Scope the review under counsel.
- Why. Privilege matters, and the scope determines the disclosure's completeness.
- Trap. An open-ended review that never concludes.
[ ] Quantify. Items, parties, destinations, transactions, and period.
- Why. Penalties are per violation and the arithmetic drives every decision.
- Trap. A qualitative description with no numbers.
[ ] [Gate] Make the disclosure decision deliberately and quickly.
- Why. Both BIS and OFAC treat voluntary self-disclosure as a substantial mitigating factor, and an initial notification can be filed while the review continues.
- Trap. Deliberating past the point where the disclosure is still voluntary.
[ ] Build the submission properly. Facts, classification and legal analysis, review methodology, root cause, remediation, records.
- Why. Incomplete disclosures invite follow-up and lose credit.
- Trap. A narrative with no supporting documents.
[ ] Remediate visibly and record it.
- Why. Enforcement authorities score whether the root cause was fixed.
- Trap. A disclosure with no accompanying programme change.
[ ] Anticipate individual exposure.
- Why. Wilful violations can be charged personally, which changes the internal dynamics.
- Trap. Interviewing employees without considering whether they need separate counsel.

Phase 20. Training and cadence

[ ] Segment training by audience. Engineering, sales and support, human resources, procurement, legal.
[ ] Use the company's own products and repositories as examples.
[ ] Deliver annually, plus onboarding, plus targeted refreshers on control changes.
[ ] Measure coverage and report it.
[ ] Quarterly. Access recertification; screening review; licence expiry check; classification currency spot check.
[ ] Annually. Full classification review; audit; training; technology control plan refresh; board report.
[ ] On product change. Reclassify before release.
[ ] On new hire or contractor. Status collected, access gated on classification.
[ ] On new counterparty. Screened with the ownership rule before engagement.
[ ] On foreign filing. Licence confirmed or six-month clearance verified.
[ ] On transaction. Diligence structured; CFIUS analysis run from the classification.

Phase 21. The classification table template

| # | Item | Type | Jurisdiction | ECCN | Reasons for control | Basis | Classified by | Date | Next review | |---|---|---|---|---|---|---|---|---|---| | 1 | Appliance v4 | Hardware | EAR | 5A002 | NS, AT, EI | Encryption functionality; see analysis A-4 | J. Rivera | 2026-01-14 | 2027-01-14 | | 2 | Crypto library | Software | EAR | 5D002 | NS, AT, EI | Implements controlled algorithms; analysis A-5 | J. Rivera | 2026-01-14 | 2027-01-14 | | 3 | Appliance design docs | Technology | EAR | 5E002 | NS, AT, EI | Required for development of item 1 | J. Rivera | 2026-01-14 | 2027-01-14 | | 4 | Web console | Software | EAR | EAR99 | — | No controlled functionality; analysis A-6 | J. Rivera | 2026-01-14 | 2027-01-14 | | 5 | Product manual | Technology | Excluded | — | — | Published under 15 C.F.R. § 734.7 | J. Rivera | 2026-01-14 | 2027-01-14 |

[ ] One row per item, including technology and software separately from hardware.
[ ] Basis column names the analysis document, not just a conclusion.
[ ] Excluded items appear in the table, with the exclusion and its basis, because the exclusion analysis is as important as the classification.
[ ] Next review date populated so currency is visible.
[ ] Named classifier, because an unattributed classification is difficult to defend.

Phase 22. The access map template

| Repository | Classification | Members | Foreign persons | Countries | Authorisation basis | Last recertified | |---|---|---|---|---|---|---| | appliance-core | 5E002 | 12 | 3 | [list] | No licence required for these combinations; analysis D-2 | 2026-04-01 | | crypto-lib | 5D002 | 8 | 1 | [list] | Licence [number], expires [date] | 2026-04-01 | | web-console | EAR99 | 140 | 41 | [list] | Not controlled | 2026-04-01 |

[ ] Every repository listed, including uncontrolled ones, so the absence of a repository from the map is visible as a gap.
[ ] Authorisation basis stated for each controlled repository, not left blank.
[ ] Recertification date populated.
[ ] A parallel table for non-repository channels — recurring meetings, support queues, contractor engagements, and cloud administrator groups.

Phase 23. Three worked scenarios

Scenario A — the open repository. A controlled design document sits in a repository open to all engineering, including thirty foreign nationals. The instinct is to apply for licences. The better answer is segmentation: move the controlled material to a restricted repository with a small membership, which frequently eliminates the requirement entirely and is a one-time engineering task rather than a recurring licensing burden.

Scenario B — the job posting. A hiring manager, told the team works on controlled technology, adds "must be a US citizen" to the posting. This is a 8 U.S.C. § 1324b exposure, and it frequently protects against nothing — the role may not touch controlled technology at all, and even where it does, permanent residents and protected individuals are US persons. The correct sequence is to determine the actual requirement for the specific role, then either restrict access or licence.

Scenario C — the historical access. A hosted service with no geolocation controls has signups from an embargoed jurisdiction over two years. Containment is immediate: deploy the controls and suspend the accounts. Then a scoped review under counsel quantifies the transactions, and the disclosure decision is made quickly, because voluntary self-disclosure carries substantial mitigation credit and the window for volunteering closes once an inquiry begins.

Phase 24. Sector boxes

[ ] Enterprise software. Encryption classification under 15 C.F.R. § 742.15 is the principal issue, plus repository access and reseller screening. Most of the codebase is EAR99 or excluded.
[ ] Hosted services. Geolocation and address screening are the dominant control, and historical access review is the first thing to run. Sanctions exposure exceeds classic export exposure by a wide margin.
[ ] Semiconductors and advanced computing. Emerging technology controls under 50 U.S.C. § 4801, foreign direct product rules, and end-use controls. Expect frequent regulatory change and a dedicated function.
[ ] Life sciences and biotechnology. Select agent and certain equipment controls, plus end-use provisions reaching EAR99 items. Research collaborations engage the fundamental research analysis under 15 C.F.R. § 734.8 frequently.
[ ] Aerospace and defence. ITAR jurisdiction under 22 C.F.R. § 121.1, registration under 22 C.F.R. § 122.1, agreements under 22 C.F.R. § 124.1, narrow exemptions under 22 C.F.R. § 125.4, and an access regime of a different order.
[ ] Universities and research institutes. The fundamental research exclusion carries most of the weight, and protecting it means scrutinising every sponsored research agreement for publication and participation restrictions.
[ ] Hardware manufacturers with offshore production. Reexport under 15 C.F.R. § 734.14, de minimis calculations, and foreign direct product analysis.
[ ] Companies raising foreign capital. 50 U.S.C. § 4565 critical technology analysis driven by the classification, with mandatory filing obligations for some transactions.

Phase 25. Working with other advisers

[ ] Export control counsel for jurisdiction determinations, licence applications, ITAR agreements, and the disclosure decision.
[ ] Immigration counsel, coordinated with export counsel, so the deemed export analysis does not produce a 8 U.S.C. § 1324b problem.
[ ] Patent counsel and docketing, who own the 35 U.S.C. § 184 workflow and the six-month clearance dates.
[ ] Engineering leadership, who own repository segmentation — the highest-return control available in a software company.
[ ] Information security, who own access recertification, logging, and encryption configuration.
[ ] Human resources, for status collection at onboarding and for offboarding access revocation.
[ ] Sales operations, who own screening at the point of order and red flag escalation.
[ ] Corporate development, for diligence structuring and the CFIUS analysis, which needs the classification done first.

Phase 26. Metrics

[ ] Classification coverage and currency.
[ ] Access exceptions. Foreign person access to controlled technology without a documented authorisation basis. Target zero.
[ ] Access recertification completion rate.
[ ] Screening coverage and rescreening frequency.
[ ] Hit resolution time.
[ ] Geolocation control efficacy, including any successful access from restricted jurisdictions.
[ ] Licence currency, including those expiring within ninety days.
[ ] Exception documentation rate.
[ ] Foreign filing licence compliance rate.
[ ] Audit findings closure rate.
[ ] Training coverage by audience.
[ ] Incidents, root causes, and remediation completion.

Phase 27. The one-paragraph brief

Export position — [entity], [date]. Jurisdiction: [no USML items / registered under 22 C.F.R. § 122.1]. Classification: [N] of [N] items classified, [N] per cent current. Controlled set: [N] repositories, [N] technology categories; remainder EAR99 or excluded under 15 C.F.R. § 734.7 and 15 C.F.R. § 734.8. Encryption reporting current to [date]. Foreign person access: [N] with controlled access, [N] requiring authorisation, [N] licences held and [N] pending. No citizenship-based hiring restrictions. Screening: [coverage], ownership rule applied, [N] hits resolved. Geolocation deployed [date]. Foreign filing licences: [N] of [N] confirmed; [N] retroactive petitions. Records per 15 C.F.R. § 762.2 in [system]. Audit [date], [N] findings, [N] closed. Disclosures: [status]. Open exposures: [list]. Next actions: [list].

Phase 28. If you can only do five things

[ ] Classify, and write down the reasoning. Everything depends on it and nothing works without it.
[ ] Apply the exclusions honestly, because they usually shrink the controlled set to something manageable.
[ ] Segment the controlled repositories rather than licensing broad access.
[ ] Deploy geolocation and address screening on any online service, and apply the ownership rule in counterparty screening.
[ ] Read the filing receipt before every foreign filing instruction.

Outcome. Three weeks of classification work produced the map everything else depended on. The controlled set narrowed from twelve repositories to two once the published information exclusion at 15 C.F.R. § 734.7 was applied properly. Segmenting those two repositories into a restricted group of twelve engineers removed the deemed export requirement for twenty-six people and left four licence questions, of which two were resolved by role changes and two by applications. A job posting requiring US citizenship was withdrawn as an unnecessary 8 U.S.C. § 1324b exposure. Screening with the ownership rule applied found a reseller majority-owned by a listed entity; it was terminated. Geolocation controls were deployed on the hosted service, and a historical access review produced a voluntary self-disclosure covering twenty-three accounts. A portfolio review against filing receipts found two foreign filings without a licence on file, one of which required a retroactive petition under 37 C.F.R. § 5.25 before 35 U.S.C. § 185 became an argument in an enforcement action. Total effort: one senior engineer at half time for a quarter, plus counsel.

Key Authorities at a Glance

The five things people get wrong

No documented classifications. Policies and training layered over an unknown. Every requirement depends on the classification, and a programme without one provides no defence.

Treating EAR99 as unregulated. Destinations, parties, and end uses reach it.

Using citizenship requirements to solve deemed exports. 8 U.S.C. § 1324b makes that a separate violation, frequently substituted for an export problem that did not exist.

Screening names without applying the ownership rule. Entities blocked by majority ownership are not on the list by name.

Not reading the filing receipt. The foreign filing licence under 35 U.S.C. § 184 is usually automatic, and the failures happen where nobody checks — surfacing later as an invalidity argument under 35 U.S.C. § 185.