What Are Export Controls and How Can Corporations Manage Risks?

Product classification is the foundation of export control compliance. The Commerce Department publishes the Commerce Control List (CCL), which assigns each item an Export Control Classification Number (ECCN) based on its technical specifications, end-use potential, and proliferation risk. If a product falls into a controlled category, an export license is generally required before shipment to most foreign destinations, with narrow exceptions for certain allied nations. Classification errors are among the most common corporate violations. Courts and enforcement agencies treat classification mistakes differently depending on whether the company conducted reasonable due diligence or acted with reckless disregard for compliance obligations.

Destination controls are equally critical as product classification. The Commerce Department maintains the Denied Parties List (DPL), the Entity List, and the Unverified List, which identify foreign nationals, companies, and government agencies to whom exports are prohibited or require special licensing. Sales to countries under comprehensive U.S. .anctions (such as Iran, North Korea, Syria, and Cuba under OFAC authority) are generally prohibited outright. End-use restrictions also apply: even if a destination is not sanctioned, shipment to certain end-uses (such as nuclear weapons development or military applications in sensitive countries) requires heightened scrutiny and often explicit licensing. Corporate due diligence typically includes screening all foreign customers and end-users against these lists before accepting orders and maintaining documentation showing that screening was performed.

The EAR and ITAR require exporters to retain records of every controlled transaction, including purchase orders, invoices, shipping documents, export licenses, and end-use certifications. For transactions to sanctioned countries or sensitive end-users, additional due diligence documentation is critical: background checks on customers, written representations from foreign parties confirming their identity and intended use, and evidence of the company's internal review process. When a corporation faces an export control investigation, the completeness and contemporaneous nature of these records often determine whether the company can defend against allegations of willful or negligent violation. Delayed or reconstructed documentation signals weakness and invites enforcement scrutiny.

End-use verification (EUV) is the process of confirming that a foreign customer will actually use a product for its stated purpose and will not divert it to a sanctioned end-use or prohibited destination. For high-risk transactions, the Commerce Department may require a company to obtain a written end-use certificate from the foreign buyer, countersigned by that country's government authority, before the export license is granted. Even when formal EUV is not mandated, corporations should conduct reasonable due diligence by requesting customer references, verifying the customer's business operations through public records or site visits, and documenting any red flags. If a customer refuses to provide reasonable assurances or exhibits suspicious behavior, the compliance-conscious corporation should decline the transaction rather than risk later allegations of willful blindness.

Export control violations are strict-liability offenses in some contexts, meaning that intent is not always required for civil liability to attach. However, the severity of penalties depends heavily on whether the violation was willful, negligent, or merely technical. A corporation that can demonstrate a reasonable compliance program, prompt self-disclosure of an error, and good-faith corrective action may negotiate reduced penalties or avoid criminal referral. Affirmative defenses include the general license exception, the de minimis rule, and the publicly available exception. Each defense requires careful factual development and documentary support.

Discovery of a potential export control violation triggers an immediate internal investigation and compliance review. The corporation should consult with counsel before making any voluntary disclosure to the government, because the timing and scope of disclosure can affect both civil and criminal exposure. Self-disclosure to the Bureau of Industry and Security, if made promptly and in good faith, may result in reduced penalties or criminal immunity. However, the company must cease the violative conduct immediately, investigate the root cause, implement corrective measures, and cooperate fully with the government's investigation.

A robust compliance program includes the following core elements: (1) a written export control policy approved by senior management and communicated to all relevant employees; (2) regular training for sales, engineering, shipping, and finance staff on classification rules, restricted-party screening, and documentation requirements; (3) a centralized export control review process that screens all foreign customers and transactions before shipment; (4) integration of restricted-party list screening into the order-entry system to flag high-risk transactions automatically; (5) retention of all export documentation in a secure, centralized repository for at least five years; and (6) periodic internal audits to identify gaps or violations before they are discovered by regulators.

Technology transfer, including the disclosure of technical data, software source code, or manufacturing processes to foreign nationals or foreign affiliates, is subject to export control even when no physical shipment occurs. The EAR distinguishes between deemed exports (release of controlled technology to a foreign national in the U.S.) and actual exports. A corporation that hires foreign nationals or has offshore research teams must implement controls to prevent inadvertent disclosure of controlled technical information. This includes physical separation of classified or controlled research areas, restrictions on email and file-sharing systems, and explicit policies prohibiting discussion of controlled technology with foreign employees or visitors.

The Commerce Department's Bureau of Industry and Security maintains a website with the current Export Administration Regulations, the Commerce Control List, and guidance on classification and licensing. Companies can request a Commodity Jurisdiction determination from BIS or DDTC to obtain an official classification ruling on a specific product before export. Legal counsel experienced in export controls can provide classification audits, compliance program design, and representation in licensing applications or government investigations. Our firm's export control team works with corporations to assess compliance posture, remediate violations, and navigate licensing and enforcement matters.