The Export Administration Regulations (EAR) are the US rules that control the export and re-export of commercial and dual-use items, including software and technical data, for reasons of national security, foreign policy, and short supply. They are administered by the Bureau of Industry and Security (BIS) within the US Department of Commerce and codified at 15 CFR Parts 730 to 774. The EAR govern items with both civilian and potential military use, which is where most cybersecurity and industrial technology falls.
What is the EAR?
It is the framework that decides whether you need a license to send a controlled item, technology, or piece of software outside the United States, and to whom. The core question is always the same: what is the item, where is it going, who is the end user, and what will it be used for. Items purely military in nature are handled separately under ITAR; the EAR covers the much larger universe of commercial and dual-use goods.
How does the EAR work?
Three mechanisms do most of the work:
- The Commerce Control List (CCL). A catalog of controlled items, each assigned an Export Control Classification Number (ECCN) that sets the reasons for control and licensing requirements. Items not on the CCL are designated EAR99.
- Licensing. Whether a license is required depends on the ECCN, the destination country, the end user, and the end use. Some transactions qualify for license exceptions.
- Deemed exports. Releasing controlled technology to a foreign national inside the United States counts as an export to that person's country, which matters for research labs and mixed-nationality engineering teams.
Who has to comply with the EAR?
Anyone who exports, re-exports, or transfers items subject to the EAR: manufacturers, software vendors, cloud providers, and their foreign partners. Because "technology" and "software" are covered, a cybersecurity or industrial-automation company can trigger EAR obligations just by sharing source code, technical documentation, or product access across a border, or with a foreign national at home.
Why does the EAR matter for cybersecurity?
Encryption and intrusion software are explicitly controlled under the EAR, so security products often carry an ECCN. Beyond the products themselves, controlling access to EAR-covered technical data is an information-security problem: you have to keep controlled files away from unauthorized foreign nationals, which means access control, segmentation, and logging around the systems that hold that data. Standards like NIST SP 800-171 and CMMC formalize those safeguards for contractors handling controlled unclassified information.
How is the EAR different from ITAR?
They cover different lists and different agencies. The EAR (Commerce/BIS) governs commercial and dual-use items on the Commerce Control List. ITAR (State Department/DDTC) governs defense articles and services on the US Munitions List. A single product line can touch both, so exporters have to classify each item and decide which regime applies before shipping or sharing it.
In practice
Compliance usually means classifying every product to an ECCN, screening end users and destinations, applying for licenses where required, and keeping records of it all. Because misclassification carries real penalties, many organizations pair engineering with trade-compliance or legal review rather than guessing.
Controlling who can reach EAR-covered technical data is an access-control problem, and identity-based segmentation is one honest part of the answer, though the EAR itself is a legal regime, not a product you buy.
