The Commerce Control List (CCL) is the list of dual-use items, commodities, software, and technology that have both commercial and military uses, that require review before export from the United States. It is administered by the Bureau of Industry and Security (BIS), part of the Department of Commerce, under the Export Administration Regulations (EAR). Every item on the list carries a classification number that determines whether a license is needed and to which countries.
How is the Commerce Control List organized?
The CCL is divided into ten categories, numbered 0 through 9:
- 0 Nuclear materials, facilities, and equipment
- 1 Materials, chemicals, microorganisms, and toxins
- 2 Materials processing
- 3 Electronics
- 4 Computers
- 5 Telecommunications and information security
- 6 Sensors and lasers
- 7 Navigation and avionics
- 8 Marine
- 9 Aerospace and propulsion
Within each category, items get an Export Control Classification Number (ECCN), a five-character code like 5A002 for certain information security hardware. The ECCN points to the reasons for control (national security, anti-terrorism, encryption) and drives the license decision through the Commerce Country Chart.
What is the difference between the CCL and the USML?
They are two separate lists with two separate regulators. The CCL sits under the EAR and covers dual-use and less-sensitive military items. The United States Munitions List (USML) sits under the ITAR and covers defense articles and services. If an item is on the USML, ITAR governs it, not the EAR. Misclassifying an item between the two is one of the most common and expensive export compliance mistakes a manufacturer makes.
Why does the CCL matter for OT and industrial technology?
Cybersecurity and industrial control technology land on the CCL more often than people expect. Encryption products, network intrusion tools, and certain SCADA and PLC components fall under Category 5 or Category 3 controls. A manufacturer that exports an industrial control system, or even shares controlled technical data with a foreign national on U.S. soil (a "deemed export"), can trigger the EAR without shipping anything across a border.
For companies in the defense industrial base, the CCL intersects with data protection: the same technical drawings and firmware parameters that count as Controlled Unclassified Information under a DoD contract may also be export-controlled technology under the EAR.
How do you comply with the CCL?
Classify first. Determine the correct ECCN for your product, either through self-classification against the list or a formal BIS classification request. Then check the Commerce Country Chart to see whether a license is required for the destination, end user, and end use. Keep records: the EAR requires you to retain export documentation for five years. Penalties for violations reach into the hundreds of thousands of dollars per count, plus loss of export privileges.
