An Export Control Classification Number (ECCN) is a five-character alphanumeric code that classifies a dual-use item on the U.S. Commerce Control List (CCL). It is administered by the Bureau of Industry and Security (BIS) under the Export Administration Regulations (EAR). The ECCN, combined with the destination country, end user, and end use, determines whether you need a license to export an item.
How is an ECCN structured?
An ECCN like 5A002 is read one character at a time. The first digit is one of ten CCL categories, for example 5 for telecommunications and information security. The letter is a product group, A for systems and equipment, D for software, E for technology. The remaining digits map the item to a reason for control, such as national security or anti-terrorism. Items that are subject to the EAR but not listed anywhere on the CCL are designated EAR99, a catch-all that usually needs no license outside embargoed destinations.
Who needs to determine an ECCN?
Any U.S. manufacturer, developer, or exporter of a physical product, software, or technology. The obligation sits with the exporter, not the government. You can self-classify by working through the CCL, request a manufacturer's classification, or file a formal commodity classification (CCATS) request with BIS when the answer is genuinely unclear. For cybersecurity and encryption products, category 5 Part 2 (information security) is the usual starting point, and some items carry additional reporting requirements even when no license is needed.
Why does ECCN classification matter for industrial and OT vendors?
Because many OT and cybersecurity products contain encryption, and encryption is one of the most tightly watched areas of the CCL. Network security appliances, VPN gateways, and industrial monitoring tools frequently classify under 5A002 or 5D002. Get the classification wrong and you face two failure modes: over-classifying and blocking legitimate sales, or under-classifying and shipping controlled technology to a restricted party. The second is an EAR violation, and penalties reach into the hundreds of thousands of dollars per violation plus loss of export privileges.
How is the ECCN different from a USML category?
The two lists split the world of controlled items. The Commerce Control List, with its ECCNs, covers dual-use goods, items with both commercial and military uses, under the EAR. The United States Munitions List (USML) covers defense articles under the International Traffic in Arms Regulations (ITAR), administered by the State Department. An item is generally controlled under one regime or the other, not both. Deciding which list applies is the first step before you ever look up an ECCN.
Related terms
- EAR, the regulations the ECCN system lives under
- Commerce Control List, where every ECCN is defined
- ITAR, the parallel regime for defense articles on the USML
- Controlled Unclassified Information, a related category of protected information
- Defense Contracting, where export controls and procurement intersect
