How Companies Self-Classify Under the EAR: NetApp, Semiconductors, and Real Examples

Short answer: Under the Export Administration Regulations (EAR), the exporter, not the government, assigns a product’s Export Control Classification Number (ECCN) or confirms it is EAR99, and takes responsibility for the result. This is self-classification. The Bureau of Industry and Security (BIS) will issue an official classification if you ask (15 CFR 748.3). The hard cases cluster around encryption, advanced computing and sensors.

That surprises a lot of first-time exporters, and it sounds intimidating until you see that companies run this process every day and many of them publish the results. The fastest way to understand self-classification is to look at how real companies do it. This guide covers three cases: the enterprise-tech pattern (why people search for “NetApp ECCN”), the hardest frontier (semiconductors and advanced computing), and the classic trap (the product everyone “knew” was EAR99 until it wasn’t).

What does self-classification under the EAR mean?

Self-classification under the EAR means the exporter compares a product’s technical specifications against the parameters on the Commerce Control List (CCL) and assigns the result. As BIS frames it, exporters are responsible for classifying their own products. You can request an official commodity classification from BIS through SNAP-R, which comes back with a CCATS number, but most companies self-classify the large majority of their catalog and save CCATS requests for ambiguous or high-stakes items.

The process follows the CCL Order of Review in Supplement No. 4 to part 774 of the EAR: confirm the item is subject to the EAR, then work from category to product group to specific entry, landing on an ECCN or, if nothing on the list describes the item, EAR99.

The difficulty is very uneven across products:

• Easy self-classification: a cotton t-shirt, a wooden chair or a basic hand tool is clearly not on the CCL. It is EAR99, and no expert is needed.
• Hard self-classification: anything whose technical characteristics approach or cross a controlled parameter, such as encryption strength, computing performance, sensor resolution or certain materials. A sense that the product “feels commercial” won’t hold up here, and getting it wrong is expensive.

Almost every difficult self-classification a commercial company faces sits in one of a few areas. The biggest by far is encryption, which is where the first example starts.

Real example 1: why do people search for “NetApp ECCN”?

People search for “NetApp ECCN” because they want the export classification that NetApp, an enterprise data-storage vendor, has assigned to its products. NetApp is far from alone. Cisco, Dell, HPE, Microsoft and most major technology vendors publish export-control classification information for their products on public export-compliance pages. Why they do this explains self-classification better than any definition.

Why is storage and networking gear export-controlled?

Storage and networking gear is controlled because it almost always uses encryption. Modern storage arrays, controllers, switches and security appliances encrypt data for confidentiality, and encryption is one of the most heavily controlled areas of the EAR. Items that use cryptography for data confidentiality above modest thresholds (symmetric algorithms over 56 bits, asymmetric over 512 bits, which covers virtually all modern encryption) fall under Category 5, Part 2 of the CCL, typically:

• ECCN 5A002: information security hardware (encrypted storage systems, security appliances, HSMs, secure communications).
• ECCN 5D002: the software equivalent.
• ECCN 5A992 / 5D992: the “mass-market” classification (Note 3 to Category 5, Part 2) for retail-type products whose cryptography the user can’t easily modify. It is less restrictive than 5A002/5D002.

So an enterprise storage vendor self-classifying a new array is mostly working out which Category 5 entry applies, and which export pathway.

What is License Exception ENC?

License Exception ENC (15 CFR 740.17) lets most encryption items export without an individual license once they are classified. It authorizes export to most destinations, but not to the embargoed Country Groups E:1 and E:2. Depending on the product, the company either files a classification request with BIS or relies on self-classification, and many ENC items require an annual self-classification report to BIS, due February 1 for the prior calendar year. Knowing the ECCN is not enough: the exporter must also know which ENC provision applies, because each authorizes a different scope.

Can you rely on a manufacturer’s published ECCN?

Yes, within limits. Under 15 CFR 740.17(b), an exporter, reexporter or transferor may rely on the producer’s self-classification, or on a CCATS issued to the producer, for eligible encryption items. So when NetApp or any other vendor self-classifies a product and publishes the ECCN and ENC details, its customers, resellers and integrators can rely on that published classification without re-classifying the hardware themselves.

If you are shipping someone else’s product, the workflow looks like this:

1. Find the manufacturer’s export-compliance or product-classification page.
2. Locate your specific product and model. Classifications are product- and version-specific.
3. Read the published ECCN (for example, a Category 5 entry) and the ENC provision or authorization.
4. Apply it to your own transaction. The ECCN is only the start; your destination, end user and end use still decide whether you can ship and how. (See the export licensing walkthrough.)
5. Verify and document. Confirm you’re looking at the right model and a current classification, and keep the record.

The lesson of the enterprise-tech pattern: serious vendors invest in self-classification and publish it, and their whole sales channel depends on that classification being well documented and reliable.

Real example 2: how are semiconductors and advanced computing items classified?

Semiconductors and advanced computing items are classified against a small set of performance-based ECCNs, and in 2026 they are the most consequential self-classification problem, even if encryption is the most common one. Advanced computing chips and the equipment to make them have moved to the center of U.S. export control. The relevant entries include:

• ECCN 3A090: advanced computing integrated circuits meeting specific performance parameters.
• ECCN 4A090: computers and systems incorporating those chips.
• ECCN 3B090 (and related 3B entries): semiconductor manufacturing equipment.

Three things make these entries high-stakes. The thresholds are precise: a chip a hair above a performance line is controlled, and below it, maybe not. The rules moved: items that were comfortably EAR99 or lightly controlled a couple of years ago now sit in controlled entries with license requirements to sensitive destinations. And the licensing posture is severe. Exports of these items to certain destination groups, and to entities judged partly by their ultimate parent, require licenses. Some are now reviewed case by case instead of under a presumption of denial; BIS’s January 2026 rule (91 FR 1684), for example, moved certain advanced computing chips for end users in China and Macau to case-by-case review.

The CCL also shows how tangled self-classification gets at this frontier. It now includes “.z” provisions that capture items described under the encryption entries (5A002) that also meet advanced-computing parameters (3A090/4A090). A single product can sit where two of the hardest control areas meet. Self-classifying it correctly is expert work, and given the destinations involved, getting it wrong is not a small error.

This is the practical side of the shift we wrote about in The New Iron Curtain Is Made of Silicon, and a core reason “AI export control” has become a live concern: the chips that train and run advanced AI are exactly the items these entries capture.

Example 3: what is the “we assumed EAR99” trap?

The “we assumed EAR99” trap is the most common self-classification failure: an ordinary-looking product that a company assumed was EAR99 without checking.

Picture a manufacturer of industrial cameras. The cameras are not on the USML and not obviously on the CCL, so the team concluded EAR99 and assumed they could sell freely. Then a foreign customer mentioned wanting the cameras for a military installation in a country of concern. That end use triggered controls the company hadn’t accounted for, and a shipment that “felt commercial” suddenly needed a license. They nearly shipped without one.

That story carries two lessons:

• A product can look mundane and still cross a controlled parameter: a security camera with encryption, a high-accuracy GPS module, a software-defined radio, a sensor with a particular resolution. A product that seems like an ordinary consumer good still needs checking against the CCL.
• Even a correct EAR99 classification doesn’t mean “ship anywhere.” EAR99 items can still need a license because of the destination, the end user or the end use. Classification tells you what the item is; it never answers the whole export question by itself. (And if there’s any doubt the item is under Commerce jurisdiction at all, start with how to tell whether a product is ITAR or EAR.)

Good self-classification tests the assumption against the actual CCL parameters.

What does good self-classification look like?

Across all three examples, companies that self-classify well follow the same practices:

• Start from the spec sheet. Classification lives in technical parameters (key lengths, performance figures, frequencies, resolutions), which product names and marketing copy rarely give you.
• Work the Order of Review: confirm EAR jurisdiction, then category, product group and entry, before defaulting to EAR99.
• Document the rationale. Write down which entry, which parameter and why not a controlled ECCN. That audit-ready record is what shows reasonable care.
• When you’re downstream, use the manufacturer’s classification and verify it: confirm the model and that the classification is current.
• Re-classify when the product or the rules change. New firmware that enables encryption, or a BIS rule that adds an entry, can change the answer. Classifications have a shelf life.
• Keep a human on the hard ones. Encryption, advanced computing and threshold-adjacent items deserve expert review. The same human-in-the-loop, audit-ready model holds across trade compliance tooling.

This is what TariffWolf and ECCN.help are built to support: a reasoned self-classification from a plain product description, with the why shown so you can verify it, scalable across a catalog, and honest about when an item is close enough to a threshold to deserve a human’s (or BIS’s) second look.

Why did self-classification get harder in 2026?

Self-classification got harder in 2026 because several things changed at once. Encryption is everywhere: it is built into ordinary hardware and software, which pulls more products into Category 5 than teams expect. Advanced-computing controls expanded, moving semiconductors and AI hardware into controlled entries with serious licensing consequences. And the lists move faster. A self-classification that was right last year can be wrong now because BIS revised a threshold or added an entry. In 2026 self-classification is an ongoing obligation, and a documented process you can re-run handles it far better than a one-time spreadsheet guess.

EAR self-classification quick reference

Frequently asked questions

Does the government assign my product’s ECCN?

Generally no. Under the EAR you self-classify, and you are responsible for the result. BIS will issue an official commodity classification, with a CCATS number, if you request one under 15 CFR 748.3, and some encryption items need a classification request to use License Exception ENC.

How do I find the ECCN for a product I didn’t make, like a NetApp array?

Check whether the manufacturer has a public export-compliance or product-classification page listing the ECCN and, for encryption items, the License Exception ENC details. For eligible encryption items, 15 CFR 740.17(b) lets you rely on the producer’s self-classification or the producer’s CCATS. Confirm the model and that the classification is current; your destination, end user and end use still govern the shipment.

Why do so many tech products have ECCN 5A002?

Because they contain encryption. BIS’s key-length guidance puts cryptography for data confidentiality under 5A002.a when it uses symmetric keys in excess of 56 bits or asymmetric (integer factorization, e.g. RSA) keys in excess of 512 bits, which covers most modern encryption. Hardware usually lands in 5A002 and software in 5D002, and many such items ship under License Exception ENC (15 CFR 740.17).

How are semiconductors classified for export?

Advanced computing chips are classified against the performance parameters in ECCN 3A090, which BIS uses to set license requirements for sensitive destinations. Review policy changes too: BIS’s January 2026 rule (91 FR 1684) moved certain advanced computing chips for end users in China and Macau from a presumption of denial to case-by-case review. Check the current CCL entry and licensing policy before each classification.

Can I just assume my product is EAR99?

No, verify it. Plenty of ordinary-looking products carry controlled features (encryption, high-accuracy GPS, certain sensors), and even genuine EAR99 items can need a license because of the destination, end user or end use. Re-check whenever the product or the rules change, since BIS revises the CCL regularly.

Where TariffWolf fits

Self-classification under the EAR is a discipline real companies run every day, and the best of them document and publish it. The easy cases are easy, and the hard ones cluster predictably around encryption, advanced computing and ordinary-looking products with hidden controlled features.

That’s the workflow TariffWolf and ECCN.help are built to make fast and defensible: export-control classification with reasoning you can read, scalable across a catalog, honest about its limits.

Don’t take our word for it. Don’t Trust Us. Try Us.

This article is for general information and is not legal advice. Company names are used only as illustrations of standard industry practice; verify any product’s classification against the manufacturer’s current published information. Export controls change frequently, so consult the current EAR and BIS guidance, or qualified counsel, for specific products and transactions.