Is My Product ITAR or EAR — and What Does Getting It Wrong Cost?

Jurisdiction is the first question in export compliance — before classification, before licensing, before anything. And it’s the most expensive question to get wrong, for a reason most exporters underestimate: a jurisdiction error doesn’t happen once. It repeats on every shipment, every foreign-national access, every transfer of that item, until someone catches it. One wrong call at the outset cascades into violations across an entire product line.

There are two ways to get it wrong, and they cost you in completely different ways. Treat an ITAR item as EAR, and you’re exporting a defense article without State Department authorization — a serious, potentially criminal violation. Treat an EAR item as ITAR, and you’ve inflicted expensive, unnecessary restrictions on yourself — lost customers, lost markets, registration fees you didn’t owe. This guide walks the determination, then puts a number on both kinds of mistake.

The short version: If your product is on the United States Munitions List (USML), it’s ITAR — administered by the State Department’s DDTC, with a license required for virtually every export. If it’s not on the USML, it falls under the EAR — administered by Commerce’s BIS, where most items are EAR99 or need no license. Determine jurisdiction first; when it’s genuinely unclear, resolve it with a Commodity Jurisdiction (CJ) request to DDTC. Getting it wrong costs you either a compliance catastrophe (under-controlling) or your competitiveness (over-controlling).

ITAR vs EAR: the two regimes in one view

The structural difference matters: ITAR has no EAR99. Under the EAR, “not on the list” usually means “ship freely.” Under ITAR, there is no “ship freely” — if it’s on the USML, it’s controlled, full stop.

How to tell which applies

Step 1 — Is it on the U.S. Munitions List?

The determination starts and often ends here. The USML (22 CFR 121.1) enumerates defense articles across 21 categories — firearms, ammunition, military aircraft, naval vessels, missiles, spacecraft, explosives, military electronics, and more. Since the 2013–2020 Export Control Reform, the USML uses “positive list” language: items are specifically enumerated by technical parameter, not broadly described. If your product, its technical data, or a related service is described on the USML, ITAR applies — period. You cannot fall back on the EAR for a USML item.

Step 2 — Mind the “specially designed” trap and the (x) catch-all

This is where exporters get caught. Each USML category ends with a paragraph (x) — a catch-all for items “specifically designed or modified” for a defense article in that category. The classic example: a generic fastener isn’t on the USML, but a fastener specifically designed for an F-35 panel can be ITAR-controlled under the catch-all.

The test isn’t whether the item looks military — it’s whether it was specifically designed or modified for a defense application (and whether it has a “predominant civil application” or is “commoditized,” terms with precise regulatory meanings that don’t match everyday usage). A part can look utterly ordinary and still be ITAR because of what it was designed for.

Step 3 — The customer does not determine jurisdiction

A common and costly assumption: “my customer is a military, so it must be ITAR.” Wrong question. A military buyer purchasing a ruggedized laptop, an industrial sensor, or commercial communications gear doesn’t make those items ITAR. The right question is “What was this product designed to do, and how does the government regulate it?” — not “who’s buying it?” Design intent and the list decide jurisdiction; the end customer does not.

Step 4 — Not on the USML? Then it’s EAR

If your item isn’t captured by the USML, it falls under the EAR, and you move to its classification: find the ECCN on the Commerce Control List, or confirm EAR99 (subject to the EAR but not listed). Note that the Export Control Reform moved many former USML items onto the CCL as the “600 series” — military-adjacent items that are now Commerce-jurisdiction. (For the EAR classification itself, see the free ECCN tool or HS and ECCN in one workflow.)

Step 5 — Genuinely unsure? Resolve it formally

When the line is honestly unclear — and for gray-area dual-use items it often is — you have two legitimate paths:

• Self-determine and document. You’re not required to ask the government. You can perform your own analysis and operate on it — provided you document it: why the item doesn’t meet USML criteria, which CCL category you reviewed, and what ECCN you assigned. That written rationale is your defense.
• Request a Commodity Jurisdiction (CJ) determination. When you can’t resolve it yourself, file a CJ request with DDTC — the official ruling on whether an item is ITAR or EAR. It’s submitted electronically on Form DS-4076 through the DECCS portal (paper is returned without action), you don’t need to be DDTC-registered to file, and it typically takes 60–90 days.

Two realities about CJs worth knowing: DDTC expects you to arrive with a preliminary determination and rationale — a “you tell us” request just gets bounced back. And a CJ is binding only on the item as described; modify the design or military application later and the original determination may no longer apply. It’s a point-in-time ruling, not a lifetime certificate.

Don’t forget technical data and “deemed exports”

ITAR doesn’t just control hardware. It controls technical data — the drawings, specs, assembly instructions, and know-how needed to develop, produce, or maintain a defense article — and defense services. Critically, releasing ITAR-controlled technical data to a foreign national, even inside the United States, counts as an export (a “deemed export”). That includes a foreign-national employee accessing controlled files, or controlled data sitting on a foreign cloud server. Companies have been penalized for exactly these scenarios. If your item is ITAR, your jurisdiction problem isn’t only at the shipping dock — it’s in your engineering share drive.

What getting it wrong actually costs

Here’s the heart of it. The two directions of error have wildly different price tags.

Direction 1 — Under-controlling (treating an ITAR item as EAR)

This is the dangerous one. If you classify a defense article as EAR and export it without DDTC authorization, every one of those exports is a potential violation — and because the jurisdiction error sits at the product level, it cascades across every transaction, every foreign-national access, and every transfer of that item. The exposure:

• Civil penalties exceeding $1 million per violation under the Arms Export Control Act (the figure is adjusted annually for inflation, and is currently above $1.2 million).
• Criminal penalties up to $1 million and 20 years’ imprisonment per violation.
• Debarment — loss of export privileges, which for a defense supplier can be existential.

Multiply a per-violation penalty by a product line’s worth of shipments and the number stops being abstract. This is why resolving jurisdiction at the outset is one of the highest-leverage compliance steps a company can take — the mistake is cheap to prevent and ruinous to discover late.

Direction 2 — Over-controlling (treating an EAR item as ITAR)

The opposite error rarely makes headlines because it’s not illegal — but it quietly bleeds you:

• Unnecessary DDTC registration fees (registration runs roughly $2,250–$3,000 per year) you didn’t actually owe.
• Self-inflicted licensing friction — applying for authorizations and accepting delays your competitors (who classified correctly) skip entirely.
• Lost markets and customers — you decline business, or price yourself out of it, by treating a commercial item as a tightly controlled defense article.
• Hiring and collaboration constraints — needlessly restricting foreign-national employees or partners from work that EAR rules would have allowed.

Over-controlling feels “safe,” but it’s a competitiveness tax. You hand rivals the deals you scared yourself out of.

And the EAR side has teeth too

Don’t read “EAR is the relaxed one” as “EAR is consequence-free.” EAR violations carry civil penalties of the greater of roughly $300,000+ per violation (inflation-adjusted) or twice the transaction value, criminal penalties up to $1 million and 20 years per violation, and denial of export privileges. Misclassifying within the EAR — or shipping a controlled item as EAR99 — is its own expensive mistake. (See the licensing walkthrough and the pre-shipment check.)

How to get the determination right — and keep it right

A few practices separate teams that handle jurisdiction cleanly from teams that discover a problem during an audit:

• Jurisdiction first, always. Decide ITAR vs EAR before you classify, price, or promise a delivery date. Everything downstream depends on it.
• Document the analysis even when you self-determine. A written rationale — why not USML, which CCL category, what ECCN — is what demonstrates reasonable care if anyone asks.
• Don’t let the customer decide for you. Ask what the item was designed to do, not who’s buying it.
• Re-check when the item changes. A CJ (or your own determination) is point-in-time. Modify the design or its military application and you may have a new jurisdiction question.
• Treat technical data like the article itself. Lock down foreign-national access to controlled data, including in the cloud.
• Make classification the dependable foundation. Both regimes start with getting the item’s nature right. That’s what TariffWolf is built for — export-control classification that distinguishes USML-relevant items, ECCNs, and EAR99 with reasoning you can read, a human in the loop on the hard cases, and an audit-ready record. (Jurisdiction-awareness is one of the things to demand of any AI trade compliance tool.)

Why this matters more in 2026

The jurisdiction line keeps moving, and enforcement keeps tightening. Export Control Reform continues to shift items between the lists, so a determination that was right a few years ago may need revisiting. Both BIS and DDTC have stepped up enforcement, particularly around sensitive destinations and advanced technology — and as controls on areas like advanced computing widen (see The New Iron Curtain Is Made of Silicon), more products sit in the gray zone where jurisdiction has to be reasoned, not assumed. The cost of guessing wrong is rising, in both directions.

Quick reference

Frequently asked questions

How do I know if my product is ITAR or EAR? Check the U.S. Munitions List (22 CFR 121.1) first. If your product, its technical data, or a related service is described there — including under a category’s (x) catch-all for items specifically designed or modified for a defense article — it’s ITAR. If it’s not on the USML, it falls under the EAR, where you then determine an ECCN or EAR99. Decide jurisdiction before anything else.

Does my customer being a military make the item ITAR? No. Jurisdiction is determined by what the item is and was designed to do, not who buys it. Militaries routinely purchase commercial, EAR-controlled items (ruggedized laptops, sensors, communications gear). Ask “what was this designed to do?” rather than “who’s the customer?”

What is a Commodity Jurisdiction (CJ) determination? It’s an official DDTC ruling on whether an item is ITAR or EAR, used when the line is genuinely unclear. You file Form DS-4076 electronically through the DECCS portal (no registration needed to file), include a preliminary determination and rationale, and typically wait 60–90 days. It’s binding only on the item as described — change the design and it may no longer apply.

What does it cost to misclassify ITAR vs EAR? Two very different costs. Under-controlling (shipping an ITAR item as EAR) risks civil penalties exceeding $1 million per violation, criminal penalties up to $1 million and 20 years, and debarment — multiplied across every affected shipment. Over-controlling (treating an EAR item as ITAR) isn’t illegal but costs you registration fees, lost markets and customers, and needless restrictions.

Are EAR penalties really that much lighter than ITAR? EAR is less restrictive operationally, but its penalties are serious: civil penalties of the greater of roughly $300,000+ per violation or twice the transaction value, criminal penalties up to $1 million and 20 years, and loss of export privileges. “Lighter than ITAR” is not “trivial.”

Does ITAR apply to technical data and software, not just hardware? Yes. ITAR controls technical data (drawings, specs, know-how) and defense services as well as hardware — and releasing controlled technical data to a foreign national, even within the U.S. or via a foreign cloud server, is a “deemed export.” If your item is ITAR, controlling internal access to its data is part of compliance.

Do I have to file a CJ if I’m unsure? No. You can perform and document your own jurisdiction analysis and operate on it. File a CJ when you genuinely can’t resolve the question, or when you want a binding government answer for a high-stakes item. Either way, document your reasoning.

The honest bottom line

ITAR or EAR is the question you answer before every other export question — and the one that punishes a wrong answer the hardest, because the error repeats across an entire product line. Check the USML first; respect the “specially designed” catch-all; ignore who the customer is and ask what the item was designed to do; and when it’s genuinely unclear, document your analysis or get a CJ. Then weigh the two costs honestly: under-controlling risks a compliance catastrophe, and over-controlling quietly taxes your competitiveness. Neither is the “safe” default — the safe default is getting it right.

That starts with classification, which is what TariffWolf does: export-control classification that reasons clearly about where an item sits, with a human in the loop and a record you can defend.

Don’t take our word for it. Don’t Trust Us. Try Us.

This article is for general information and is not legal advice. Penalty amounts are adjusted for inflation and change; export controls and the USML/CCL shift over time. Verify against the current ITAR, EAR, and DDTC/BIS guidance, or consult qualified export-control counsel for specific products.