export-controls

name	export-controls
description	Use when identifying export control and sanctions laws that affect software distribution and encryption. Covers US EAR and ITAR, EU Dual-Use Regulation, Wassenaar Arrangement, OFAC sanctions, and encryption export rules that apply to software products distributed internationally. USE FOR: export controls, EAR, ITAR, OFAC sanctions, Wassenaar Arrangement, encryption export, ECCN, dual-use technology, embargoed countries, deemed exports, open-source encryption exemptions DO NOT USE FOR: implementing encryption (use security/cryptography), trade secret protection (use intellectual-property), general international business law (consult trade counsel)
license	MIT
metadata	{"displayName":"Export Controls","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"U.S. Bureau of Industry and Security — Export Administration Regulations (EAR)","url":"https://www.bis.gov/regulations"},{"title":"The Wassenaar Arrangement","url":"https://www.wassenaar.org"},{"title":"OFAC Sanctions Programs and Information","url":"https://ofac.treasury.gov/sanctions-programs-and-information"}]

Export Controls

Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.

Overview

Software — especially software containing encryption — is subject to export control laws. Even making software available for download on the internet can constitute an "export." Violations carry severe criminal and civil penalties, including imprisonment and fines in the millions of dollars. Export controls exist to prevent sensitive technology from reaching hostile actors, embargoed nations, or end-uses that threaten national security. For software companies distributing products internationally, understanding these regimes is not optional — it is a legal necessity.

Key Export Control Regimes

Regime	Jurisdiction	Scope	Enforcement
EAR (Export Administration Regulations)	US	Commercial and dual-use items including software	Bureau of Industry and Security (BIS), Department of Commerce; civil and criminal penalties
ITAR (International Traffic in Arms Regulations)	US	Defense articles and defense services	Directorate of Defense Trade Controls (DDTC), Department of State; criminal penalties up to $1M per violation
EU Dual-Use Regulation 2021/821	EU	Dual-use items including cyber-surveillance technology	Member state export licensing authorities
Wassenaar Arrangement	42 participating countries	Multilateral framework for conventional arms and dual-use goods and technologies	Implemented through each member state's national legislation
OFAC Sanctions	US	Transactions with embargoed countries, entities, and individuals	Office of Foreign Assets Control (OFAC), Department of the Treasury; strict liability penalties

Software-Specific Concerns

The following categories of software and technology commonly trigger export control requirements:

• Encryption algorithms — Software implementing AES, RSA, elliptic curve, and other cryptographic algorithms is classified as a controlled item under most export control regimes.