ITAR controls defense articles listed on the United States Munitions List and is enforced by the State Department's Directorate of Defense Trade Controls; EAR controls dual-use items on the Commerce Control List and is enforced by the Commerce Department's Bureau of Industry and Security. A guided-missile component is ITAR; a navigation chip with military applications can be EAR. Which list a product sits on determines the licensing agency, the export authorization path, and the penalty exposure, and per the State Department's published penalty notices, ITAR violations have drawn civil settlements in the tens and hundreds of millions of dollars as recently as 2024.
Advanced Primitive publishes information, not legal advice.
How does a company know which regime applies?
The starting point is self-classification against the United States Munitions List. If the item is specifically designed or adapted for military use and described in a USML category — firearms, ammunition, guided missiles, military aircraft, military electronics among the twenty-one categories — it is an ITAR defense article. Everything not on the USML falls to the EAR and the Commerce Control List, which uses Export Control Classification Numbers. The State Department's 2020 decision to move certain military firearms parts and some spacecraft items from the USML to the CCL showed the boundary moves: jurisdiction over a product can change by rule, and per Federal Register notices, companies had to re-file classifications when it did. When jurisdiction is ambiguous, the agencies issue formal commodity-jurisdiction determinations, and per DDTC published guidance, the request itself goes to the agency suspected to hold jurisdiction.
What does ITAR actually restrict?
ITAR restricts the export of defense articles and defense services, and — the part that surprises newcomers — the temporary import of defense articles and any disclosure of technical data to foreign persons inside the United States. A conversation with a foreign-national engineer about controlled technical data can be an export, which is why per DDTC guidance employers must verify eligibility before staffing controlled programs. Authorization paths are case-by-case licenses, and exemptions: the Canadian exemption, exemptions for US government agencies, and the specific exemptions in 22 CFR 120-130. Registration with DDTC is mandatory for manufacturers, exporters, and brokers of defense articles — registration is not a license, a distinction DDTC emphasizes in its own compliance materials.
How is EAR different in practice?
EAR is broader but generally lighter. Dual-use items on the CCL are classified with an ECCN; items not listed anywhere are designated EAR99 and typically need no license unless a sanctions or party-based prohibition applies. EAR licensing depends on the destination, end user, and end use, calculated through the Commerce Country Chart, and BIS maintains restrictions on entities — the Entity List — that attach license requirements regardless of item type. Per BIS annual reports, the agency processes far more classification and license activity than DDTC, and the license exception framework — exceptions like STA (Strategic Trade Authorization) — allows many low-risk allied-destination exports to proceed without an individual license. For defense primes, most weapons work never touches EAR; for suppliers of electronics, materials, and software, EAR is the operative regime far more often.
What are the penalties when the regimes are violated?
Both carry criminal and civil exposure, but the headline cases are ITAR. Per State Department enforcement notices, recent civil settlements include sums well into nine figures for systematic unauthorized exports — Raytheon's 2024 settlement with the departments of State, Commerce, and Justice involved what the department described as one of the largest defense-trade resolutions to date. Violations typically involve exports without authorization, use of exemptions that did not apply, or technical-data disclosures to foreign persons. EAR cases are prosecuted under the Export Control Reform Act of 2018 penalties framework, and BIS per its own enforcement releases has issued seven-figure penalties for Russia-related and China-related violations in 2023 and 2024.
Related stories: NDAA vs Appropriations: What Each Bill Actually Controls · How FMF Turns US Budget Lines Into Allied Buying Power.
How should a defense supplier structure compliance?
Two practices separate the disciplined from the rest. First, documented classification: a written determination of USML or CCL jurisdiction for every product, revisited when rules change, because per DDTC guidance misclassification is treated as a root cause in most enforcement actions. Second, a real ITAR-compliant access-control regime for technical data — segregated networks, employee eligibility checks, and marked documents — since technical-data violations are the most common charge in published consent agreements. Companies that straddle both regimes typically maintain separate authorization workflows rather than assuming the lighter EAR posture applies, and per consent agreements reviewed by the State Department, the costliest cases involved treating ITAR items as if EAR exceptions covered them.
- USML — the Munitions List of 21 categories of defense articles; jurisdiction of ITAR.
- CCL / ECCN — the Commerce Control List and its classification numbers; jurisdiction of EAR.
- Commodity jurisdiction — the formal process to resolve which agency controls an item.
How did Export Control Reform change the boundary?
The Export Control Reform initiative launched in 2009 aimed to build "a single list, a single licensing agency, a single enforcement agency" — the phrase used by the State Department at the time — and its concrete result was rule-based movement of items between the lists. Military aircraft engines, certain gas turbine engines, and some spacecraft-related items were re-categorized in successive Federal Register rules between 2013 and 2020, some onto the CCL with a 600-series or 9x515 series designation. Those series matter to suppliers: a 600-series item on the CCL is still military in character, so it carries EAR treatment that is deliberately stricter than ordinary dual-use items, per BIS published rules. The lesson from the reform years is that jurisdiction is administrative, not physical — the same machined part changed legal status overnight when its USML category was amended, and companies that tracked the rulemakings re-classified on schedule while others discovered the change in an audit.
What is a deemed export and why do staffing decisions turn on it?
A deemed export is the release of controlled technology to a foreign person within the United States, and in both regimes it is treated as an export to that person's country or countries of nationality. For ITAR, per DDTC guidance, companies may need to establish eligibility for the employee — typically through permanent residency or a licensing arrangement — before granting access to technical data. For EAR, BIS publishes a deemed-export rule and a validation process for employment offers. Practical consequences follow: program staffing plans, lab access lists, and even conference attendance can all be constrained by deemed-export analysis, and published consent agreements show companies charged for exactly this — foreign-person access to controlled data without the required authorization. Defense suppliers in university-adjacent and research-heavy fields treat the deemed-export screen as a standard onboarding step, and the agencies' own guidance makes clear that intent is not a defense: an accidental disclosure is still a disclosure.
How do the two regimes interact with government sales?
Government-to-government sales through Foreign Military Sales sit on top of the export-control regimes rather than replacing them. An FMS case still requires the recipient government to use the hardware as approved, and third-party transfers require US consent, but the prime's direct exposure is lower because the US government is the exporter of record. Direct Commercial Sales put the compliance burden on the company: every license, every end-use certificate, every brokering activity. Per DSCA published case data, the FMS pipeline has run on the order of $50 to $80 billion in annual cases in recent years, and industry per its own filings treats the two channels differently — which is also why a supplier's jurisdiction determination affects not only where it can sell but through which channel the sale is most efficient. A misclassified item discovered mid-case can stall a government deal as surely as a commercial one.
For a defense-technology industry
For a defense-technology industry built on exports — the largest US primes derive a third or more of revenue abroad per their annual filings — the ITAR/EAR boundary is not paperwork. It sets which customers can be served, how fast deals close, and how much compliance infrastructure a supplier must fund before the first sale.