Short answer: You find an Export Control Classification Number (ECCN) by working through the Commerce Control List (CCL) in the order set by Supplement No. 4 to 15 CFR Part 774. Confirm the item is subject to the Export Administration Regulations (EAR), pick the category and product group, then test the item’s real specifications against every parameter of each candidate entry. When no entry describes the item, it is EAR99. A supplier’s ECCN is useful evidence, but 15 CFR 732.3(b)(1) makes the exporter responsible, and the Bureau of Industry and Security (BIS) will classify the item if you file a request.
Most wrong ECCNs come from two habits: stopping at the first entry whose heading sounds right, and copying a code off an old datasheet. Below are three parameter tests you can reuse, then supplier codes, the government routes when you are stuck, and how the same item reads under the EU and Indian lists. The theory behind the Order of Review is in our guide on how to classify dual-use products.
Before the CCL: is the item subject to the EAR?
The CCL only applies to items subject to the EAR, so jurisdiction comes first. Under 15 CFR 734.3(b)(1), items exclusively controlled by other agencies are outside the EAR: the State Department’s International Traffic in Arms Regulations (ITAR) for the U.S. Munitions List (USML), Treasury’s Office of Foreign Assets Control (OFAC), the Nuclear Regulatory Commission, the Department of Energy, the Patent and Trademark Office, and certain Foreign Military Sales items.
Supplement No. 4 puts the USML first. If the USML describes the item, it is a defense article and there is no CCL review. If not, Step 3 sends you to the 600 series and 9×515 entries, which hold military and spacecraft items moved off the USML and take precedence over any other ECCN. Note that a BIS classification does not settle jurisdiction: 15 CFR 748.3(b)(3) says it cannot be relied on as evidence that the item is subject to the EAR.
How do you narrow the category and product group?
Narrow the CCL by what the item does, not by its ERP description. 15 CFR 738.2 sets ten categories, from 0 (nuclear and miscellaneous) to 9 (aerospace and propulsion), and five product groups: A equipment and components, B test and production equipment, C materials, D software, E technology. A microcontroller sits in 3A; its firmware in 3D.
The three digits after the letter tell you why the entry exists. Under Table 1 to 738.2(d)(1), 000 to 099 are national security entries, 100 to 199 missile technology, 200 to 299 nuclear nonproliferation and 300 to 399 chemical and biological. The 500 range holds spacecraft and firearms entries, and the 600 range holds Wassenaar munitions and former USML items. Numbers from 990 to 999 are anti-terrorism (AT), regional stability or UN sanctions entries; 3A991 and 5A992 are both controlled for AT reasons only. And the HTSUS (US Harmonized Tariff Schedule) code is no guide to the CCL category.
How do you read a CCL entry?
Every ECCN has the same layout: License Requirements (the reasons for control and which paragraphs they cover), List Based License Exceptions, then the List of Items Controlled with Related Controls, Related Definitions and the Items paragraphs. The parameters are in the Items paragraphs. The traps are in the notes. Read to the lowest paragraph, because 3A001 is not a classification and 3A001.a.2.c is. Read every Note and Technical Note, since a Note can remove an item from a paragraph that otherwise fits. Treat words in quotation marks as defined terms: 15 CFR 772.1 defines the ones used across the CCL, and a term used in only one ECCN is defined in that entry’s Related Definitions. Follow Related Controls to entries that may describe the item more specifically.
Three parameter tests, worked through
Each test uses a hypothetical product. The 3A001, 3A991 and 5A002 text comes from the CCL as republished in 85 FR 78684 (December 4, 2020); the other rules were read in the eCFR in October 2026. BIS’s February 24, 2023 rule implementing the 2021 Wassenaar decisions (88 FR 12108) amended other 3A001 paragraphs but left 3A001.a.2 as quoted here. Still check the live entry before relying on a threshold, because Wassenaar Arrangement amendments change CCL numbers most years.
Test 1: is this microcontroller 3A001.a.2 or 3A991.a?
Take a 32-bit microcontroller with a 120 MHz clock, sold in four temperature grades from one die. 3A001.a.2 covers microcontroller microcircuits (and several other integrated circuit types) rated for operation above 398 K (+125 °C), below 218 K (-55 °C), or over the entire 218 K to 398 K range. A Note excludes integrated circuits designed for civil automobile or railway train applications. A chip that misses 3A001 goes next to 3A991.a, which catches these microcircuits if, among other features, the clock frequency rate exceeds 25 MHz. 3A991 is AT-only.
| Grade (example) | Rated ambient range | 3A001.a.2 test | Result |
|---|---|---|---|
| Commercial | 0 to +70 °C | No rating met | 3A991.a.2 (clock over 25 MHz) |
| Industrial | -40 to +125 °C | None met: +125 °C is not above 398 K, and -40 °C does not reach 218 K | 3A991.a.2 |
| Extended | -55 to +125 °C | Covers the entire 218 K to 398 K range (a.2.c) | 3A001.a.2.c |
| Automotive | -40 to +150 °C, designed for vehicles | Above 398 K, but the civil automobile Note applies | 3A991.a.2, if the automotive design is documented |
The controlling word is “rated”: the datasheet rating decides, not what the chip survives in a lab. One grade moves the same silicon from an AT-only entry into a national security entry, so keep the datasheet revision in the record. A slower chip could miss 3A991.a too; whether it is then EAR99 depends on the rest of Category 3, and on Category 5 if it has a cryptographic engine.
Test 2: is this router 5A002 or 5A992?
5A002.a covers items designed or modified to use “cryptography for data confidentiality” with a “described security algorithm”, where that capability is usable or can be activated without a secure mechanism; 5A002.a.2 names networking equipment. The Technical Note draws the line at a symmetric key longer than 56 bits, integer factorization (such as RSA) above 512 bits, or elliptic-curve discrete logarithms above 112 bits. Any router running an AES-256 VPN meets 5A002.a.2 on its face.
The exit is Note 3 to Category 5, Part 2, the mass market note. In broad terms it covers items sold to the public from stock through ordinary retail channels, with cryptography the user cannot easily change, that buyers install without substantial supplier support; read its full conditions before relying on it. Under 15 CFR 742.15, items meeting Note 3 are classified 5A992 (5D992 for software), and the CCL designates such commodities 5A992.c.
Router A is a small-office router sold in retail and online stores, set up by the buyer with a phone app, its VPN fixed in firmware: a candidate for 5A992.c. Router B is a carrier edge router with IPsec VPN, sold direct and installed by the vendor’s integrators, with aggregate encrypted throughput well above 250 Mbps. Its primary function is networking, not information security (which would put it in 5A002.a.1), so it stays in 5A002.a.2. 15 CFR 740.17(b)(2)(i)(A) treats encrypted throughput of 250 Mbps or more as network infrastructure, and under 740.17(b)(2) License Exception ENC generally becomes available 30 days after a classification request is submitted to BIS. Mass market status does not end every duty: 740.17(e)(3) requires an annual self-classification report, received by February 1 for the previous calendar year’s exports, for mass market encryption components and executable software that meet the criteria in 740.17(b)(1).
Test 3: does this machined housing escape “specially designed”?
A machine shop makes an aluminum housing to a customer’s drawing. The customer fits it to an instrument listed in an ECCN whose parts paragraph uses “specially designed”, and to a commercial EAR99 version of that instrument. The shop wants to ship spare housings abroad.
Paragraph (a)(2) of the definition in 15 CFR 772.1 catches a part for use in or with a commodity enumerated or otherwise described on the CCL or USML, so the housing is caught. A caught part is released if any of paragraphs (b)(1) to (b)(6) applies:
- (b)(1): identified in an ECCN paragraph without “specially designed”, or as EAR99 in a commodity jurisdiction determination or a 748.3(e) classification.
- (b)(2): a fastener, washer, spacer, insulator, grommet, bushing, spring, wire or solder.
- (b)(3): same function, performance and same or equivalent form and fit as a part used in an item in production that is not enumerated on the CCL or USML, or is AT-only.
- (b)(4): developed knowing it would serve both a listed item and an EAR99 or AT-only item.
- (b)(5): developed as a general purpose part.
- (b)(6): developed for AT-only and EAR99 items, or only for EAR99 items.
The housing is not a fastener. (b)(3) fits if the EAR99 instrument is in production with the identical housing; BIS’s specially designed FAQs say the release then applies regardless of original design intent. If the commercial version is still in development, (b)(3) is not yet available. (b)(4) needs documents created during development, and a memo written after the controlled product shipped does not count. If a release holds, keep going through the CCL; if nothing else describes the housing, it is EAR99. For government confirmation of a (b)(3) release, 748.3(e) provides a classification reviewed by Commerce, State and Defense.
What should you do with a supplier’s ECCN?
Use a supplier’s ECCN as evidence, check it, and keep the record. Nothing in the EAR stops you from starting there, and for a finished commercial product it is often the best data point you have. But 15 CFR 732.3(b)(1) says the exporter, reexporter or transferor “is responsible for correctly classifying the items in a transaction,” and a misclassification does not remove a license requirement.
- Get the ECCN in writing to the lowest paragraph, tied to a part number and datasheet revision.
- Ask whether it is a self-classification or backed by a BIS classification number.
- Confirm your item is the one they classified; a different grade, firmware build or radio module is a different item.
- Re-check after CCL amendments, and run your own test where a different answer would change a license outcome.
The ECCN also has to reach the Electronic Export Information (EEI). Under 15 CFR 758.1(g)(3), a No License Required shipment carries its ECCN on required EEI if it has any reason for control beyond AT; AT-only items need it for China, Russia or Venezuela. For how manufacturers publish their own codes, see how companies self-classify under the EAR. Large catalogs stall at this step, with hundreds of supplier codes and no record of any test. TariffWolf’s export control workbench runs the CCL parameter checks against your technical data, records the reasoning for each ECCN or EAR99 result, and sends dual-use edge cases to an expert reviewer.
What if no ECCN fits: EAR99, CCATS or commodity jurisdiction?
If no ECCN in any category describes the item, Step 6 of the Order of Review makes it EAR99. That is a conclusion, not a default, and it does not mean license-free. If you are unsure, 732.3(b)(2) gives you a right to ask BIS. Under 748.3 you file in SNAP-R, up to six items per request, with a recommended classification in Block 22(a) and technical literature attached. BIS assigns a Commodity Classification Automated Tracking System (CCATS) number, and 15 CFR 750.2(a) says classification requests “will be answered within 14 calendar days after receipt.” A CCATS answers which ECCN applies, not whether the State Department claims the item. That question goes to the Directorate of Defense Trade Controls (DDTC) on Form DS-4076 under 22 CFR 120.12, with a preliminary response within 10 working days of a complete request.
| Your question | Route | Rule |
|---|---|---|
| Which ECCN fits an item clearly under Commerce? | Documented self-classification | 15 CFR 732.3(b)(1) |
| Which ECCN fits, confirmed by BIS? | Classification request (CCATS) | 15 CFR 748.3, 750.2(a) |
| Is my part released under (b)(3)? | Interagency-cleared classification | 15 CFR 748.3(e) |
| Is the item on the USML at all? | Commodity jurisdiction request (DS-4076) | 22 CFR 120.4, 120.12 |
How does the same item read under EU Dual-Use and SCOMET?
Annex I to Regulation (EU) 2021/821 is built from the same multilateral regimes as most of the CCL, so categories 0 to 9, product groups A to E and many numbers match. The extended-grade microcontroller is 3A001.a.2.c in both systems, and Router B meets a 5A002 description in both; the EU list has its own Cryptography Note. The gaps come from what the United States added. The EU list has no 600 series, no 9×515 and no x99x anti-terrorism entries, so the industrial-grade chip that is 3A991.a.2 in the United States is not listed in the EU at all and is caught only by the end-use catch-all in Article 4. A crosswalk that maps every ECCN to an EU number will invent EU entries.
India’s SCOMET list (Special Chemicals, Organisms, Materials, Equipment and Technologies) runs Categories 0 to 8, with the Wassenaar dual-use items grouped in Category 8 under its own numbering. An ECCN does not translate to a SCOMET entry by number; repeat the parameter test against the SCOMET text.
Related reading
- Chapter 29, 38 or 39? Classifying chemicals and plastics by the notes
- Related-party pricing and assists in customs value
- Is My Product ITAR or EAR?
- HS and ECCN Classification in One Workflow
Frequently asked questions
How do I find the ECCN for my product?
Rule out the USML, then follow the Order of Review in Supplement No. 4 to 15 CFR Part 774: the 600 series and 9×515 entries first, then the rest of the CCL by category and product group. For each candidate ECCN, compare every parameter to your datasheet and read the Notes. An item no entry describes is EAR99.
Can I use my supplier’s ECCN?
You can use it as information, and for unmodified commercial products it is a good starting point. Under 15 CFR 732.3(b)(1) the exporter stays responsible, so confirm the code matches your exact part and revision and re-check it after CCL changes.
How do I know if my product is EAR99?
Your product is EAR99 only after you have ruled out the USML and every CCL entry that could describe it, including x99x entries such as 3A991 and 5A992 and the “specially designed” catch for parts. Record which entries you checked and why each failed. If you remain unsure, ask BIS under 15 CFR 748.3.
How long does a BIS classification request take?
15 CFR 750.2(a) says BIS will answer classification requests within 14 calendar days after receipt. Requests go through SNAP-R with up to six items each, and the answer carries a CCATS number.
The code is five characters and a few paragraph letters. The work is the parameter test behind it, written down with the datasheet revision, the Notes you read and any release you relied on. With that record, a supplier change or a BIS question is a short re-check instead of a new project.
If you have a parts list full of supplier ECCNs nobody has tested, TariffWolf’s export control workbench runs the parameter checks, records why each item lands where it does, and routes dual-use edge cases to an expert. Bring five to ten difficult SKUs to a call and look at the reasoning before you decide.
Pick a time on the calendar that loads next — no email back-and-forth.
Sources
- Supplement No. 4 to 15 CFR Part 774, Order of Review (eCFR)
- 15 CFR 772.1, “specially designed” (BIS)
- 15 CFR 732.3 (eCFR)
- 15 CFR 748.3, classification requests (eCFR)
- 15 CFR 740.17, License Exception ENC (eCFR)
- 85 FR 78684 (December 4, 2020), CCL text for 3A001, 3A991 and 5A002
- 15 CFR 738.2, CCL structure (BIS)
- 22 CFR Part 120, commodity jurisdiction (eCFR)