Is My Product ITAR or EAR — and What Does Getting It Wrong Cost?

Short answer: Review the U.S. Munitions List (USML, 22 CFR 121.1) before the Commerce Control List (CCL). If the USML describes your product, its technical data or a related service, the International Traffic in Arms Regulations (ITAR) apply and the State Department’s Directorate of Defense Trade Controls (DDTC) licenses it. If not, the item generally falls under the Export Administration Regulations (EAR), run by Commerce’s Bureau of Industry and Security (BIS), though some items are controlled by other agencies or are not subject to the EAR at all. When the line is genuinely unclear, resolve it with a Commodity Jurisdiction (CJ) request to DDTC. A wrong call costs money either way: ITAR civil penalties currently reach $1,271,078 per violation or twice the transaction value (22 CFR 127.10), and treating an EAR item as ITAR costs DDTC registration from $3,000 a year (22 CFR 122.3) plus lost sales.

If you want the basics first, start with our plain primer on how to tell ITAR from EAR. This guide goes further: the order of review, the “specially designed” and 600-series questions where most mistakes happen, and what each kind of mistake costs.

Jurisdiction is the first question in export compliance, before classification and before licensing. It is also the most expensive one to get wrong, for a reason many exporters underestimate: a jurisdiction error repeats on every shipment, every foreign-national access and every transfer of that item until someone catches it. One wrong call at the outset becomes violations across an entire product line.

There are two ways to get it wrong, and they cost you differently. Treat an ITAR item as EAR, and you are exporting a defense article without State Department authorization, a serious and potentially criminal violation. Treat an EAR item as ITAR, and you take on expensive restrictions you never needed: lost customers, lost markets, registration fees you didn’t owe.

How do ITAR and EAR compare?

ITAR and EAR differ in agency, list, licensing posture and registration, as the table shows.

The structural difference that matters most: ITAR has no EAR99. Under the EAR, “not on the list” usually means “ship freely.” Under ITAR, anything on the USML is controlled.

What is the order of review for ITAR vs EAR?

The order of review for jurisdiction is USML first, CCL second. The EAR’s own order of review (Supplement No. 4 to part 774 of the EAR) says so directly: if an item is on the USML, it is a defense article subject to the ITAR and there is no need to review the CCL.

Step 1: Is the product on the U.S. Munitions List?

The USML check is where the determination starts and often ends. The USML (22 CFR 121.1) lists defense articles across 21 categories: firearms, ammunition, military aircraft, naval vessels, missiles, spacecraft, explosives, military electronics and more. Since the 2013–2020 Export Control Reform, the USML uses “positive list” language, which means items are enumerated by technical parameter instead of described broadly. The ITAR’s order of review (22 CFR 120.11) tells you to start from the item’s general characteristics, find the right category, then match it to a specific entry, and to prefer an enumerated entry over a “specially designed” catch-all when both fit. If your product, its technical data or a related service is described on the USML, ITAR applies. You cannot fall back on the EAR for a USML item.

Step 2: Is it caught as “specially designed”?

“Specially designed” is the ITAR term, defined at 22 CFR 120.41, that catches parts and components because of what they were developed for. Many USML entries control parts, components, accessories and attachments that are specially designed for a listed article. Category VIII(h)(1), for example, covers those specially designed for listed aircraft (the F-35 among them), excluding parts common to aircraft that are or were in production and are not listed. A generic bracket is not on the USML. A bracket developed for an F-35 panel, with no commercial counterpart, can be.

Appearance doesn’t decide the test. Section 120.41(a) catches an item that, through its development, has properties peculiarly responsible for the controlled performance in a USML entry, or that is a part, component, accessory, attachment or software for use in or with a defense article. Section 120.41(b) then releases it in five cases, among them basic hardware such as fasteners, washers and springs (regardless of form or fit), parts matching one used in a non-USML commodity already in production, and items developed for both USML and non-USML use or as general-purpose items. A part can look ordinary and still be ITAR, and a part designed for a military program can still be released.

One common confusion: paragraph (x) in a USML category is not a “specially designed” catch-all. In Category VIII, paragraph (x) covers “commodities, software, and technology subject to the EAR used in or with defense articles controlled in this category.” The catch-all for non-specific parts and components that the EAR uses is the “.x” paragraph of 600-series ECCNs (Step 4).

Step 3: Does a military customer make the product ITAR?

A military customer does not make a product ITAR. Note 2 to 22 CFR 120.3 states that the intended use of an article after export, military or civilian, is not by itself a factor in deciding whether the ITAR applies. A military buyer purchasing a ruggedized laptop, an industrial sensor or commercial communications gear doesn’t make those items ITAR. The useful question is “What was this product designed to do, and how does the government regulate it?” Design intent and the list decide jurisdiction.

Step 4: Not on the USML? Check the 600 series before the rest of the CCL

An item that the USML does not capture generally falls under the EAR (some items belong to other agencies, as 22 CFR 120.11(d) notes), and the next job is its classification: an Export Control Classification Number (ECCN) on the Commerce Control List, or EAR99 (subject to the EAR but not listed). Export Control Reform moved many former USML items onto the CCL as the “600 series,” ECCNs whose last three digits run in the 600s and cover military items now under Commerce jurisdiction. The EAR’s order of review puts them early: 600-series and 9×515 entries “trump other ECCNs on the CCL,” then you check their “.x” catch-all paragraphs for non-specific parts and components, then the rest of the CCL, and only then EAR99. For the EAR classification itself, see the free ECCN tool or HS and ECCN classification in one workflow.

Step 5: What if you genuinely can’t tell?

When the ITAR or EAR line is honestly unclear, and for gray-area dual-use items it often is, you have two legitimate paths:

• Self-determine and document. You are not required to ask the government. You can do your own analysis and operate on it, provided you write it down: why the item doesn’t meet USML criteria, which CCL category you reviewed and what ECCN you assigned. That written rationale is your defense.
• Request a Commodity Jurisdiction (CJ) determination, the official DDTC ruling on whether an item is ITAR or EAR. Under 22 CFR 120.12 you submit it electronically on Form DS-4076 (through the DECCS portal; paper is returned without action), and you don’t need to be DDTC-registered to file. DDTC consults with Defense and Commerce. A CJ typically takes 60–90 days; the regulation lets you ask in writing for expedited processing if there is no final determination after 45 days.

Two things to know about CJs. DDTC expects you to arrive with a preliminary determination and rationale; a “you tell us” request gets bounced back. And a CJ binds only the item as described. Modify the design or its military application later and the original determination may no longer apply. It is a point-in-time ruling.

Does ITAR control technical data as well as hardware?

ITAR controls technical data and defense services as well as hardware. Technical data means the drawings, specs, assembly instructions and know-how needed to develop, produce or maintain a defense article. Under 22 CFR 120.50(a)(2), releasing ITAR technical data to a foreign person inside the United States is an export (a “deemed export”). That includes a foreign-national employee opening controlled files. Controlled data sitting on a foreign cloud server is also a risk: unless it meets the end-to-end encryption conditions in 22 CFR 120.54(a)(5), storing it abroad can be an export. Companies have been penalized for exactly these scenarios. If your item is ITAR, the jurisdiction problem sits in your engineering share drive as well as at the shipping dock.

What does a wrong ITAR or EAR call cost?

A wrong jurisdiction call costs very different amounts depending on which direction you got it wrong.

What happens if you treat an ITAR item as EAR?

Treating an ITAR item as EAR (under-controlling) is the dangerous error. If you classify a defense article as EAR and export it without DDTC authorization, every one of those exports is a potential violation, and because the error sits at the product level, it repeats across every transaction, foreign-national access and transfer of that item. The exposure:

• Civil penalties under the Arms Export Control Act above $1 million per violation. The figure is adjusted for inflation; 22 CFR 127.10 currently sets it at $1,271,078 or twice the value of the transaction, whichever is greater.
• Criminal penalties of up to $1 million and 20 years’ imprisonment per violation (22 U.S.C. 2778(c)).
• Debarment, meaning loss of export privileges, which for a defense supplier can end the business.

Multiply a per-violation penalty by a product line’s worth of shipments and the number stops being abstract. The mistake is cheap to prevent at the outset and ruinous to discover late.

What does over-controlling an EAR item as ITAR cost?

Treating an EAR item as ITAR (over-controlling) rarely makes headlines because it isn’t illegal, but it bleeds money and business:

• DDTC registration fees you didn’t owe. Under 22 CFR 122.3, registration starts at $3,000 a year (Tier 1) and is $4,000 or more for Tiers 2 and 3.
• Licensing friction you chose: applying for authorizations and accepting delays that competitors who classified correctly skip.
• Lost markets and customers, because you decline business, or price yourself out of it, by treating a commercial item as a tightly controlled defense article.
• Hiring and collaboration limits: keeping foreign-national employees or partners away from work the EAR would have allowed.

Over-controlling feels safe, and it still taxes your competitiveness: you hand rivals the deals you scared yourself out of.

Are EAR penalties much lighter than ITAR penalties?

EAR penalties are lighter on the civil side but still serious. Under the Export Control Reform Act (50 U.S.C. 4819), the civil penalty is the greater of $300,000 per violation, adjusted for inflation to $374,474 in 15 CFR 6.3, or twice the transaction value. Criminal penalties reach $1 million and 20 years per violation, and BIS can deny export privileges. Misclassifying within the EAR, or shipping a controlled item as EAR99, is its own expensive mistake. (See the export licensing walkthrough and the pre-shipment compliance check.)

How do you keep a jurisdiction determination right?

Teams that handle jurisdiction cleanly, and avoid finding a problem during an audit, tend to follow these practices:

• Decide ITAR vs EAR before you classify, price or promise a delivery date. Everything downstream depends on it.
• Document the analysis even when you self-determine. A written rationale (why not USML, which CCL category, what ECCN) is what shows reasonable care if anyone asks.
• Base jurisdiction on what the item was designed to do. The buyer’s identity doesn’t decide it.
• Re-check when the item changes. A CJ, or your own determination, is point-in-time. Modify the design or its military application and you may have a new jurisdiction question.
• Treat technical data like the article itself, and lock down foreign-national access to it, including in the cloud.
• Get classification right as the base for both regimes. That’s what TariffWolf is built for: export-control classification that distinguishes USML-relevant items, ECCNs and EAR99 with reasoning you can read, a human in the loop on the hard cases, and an audit-ready record. (Jurisdiction awareness is one of the things to demand of any AI trade compliance tool.)

Why does the ITAR or EAR question need rechecking in 2026?

The ITAR/EAR line keeps moving: Export Control Reform continues to shift items between the lists, so a determination that was right a few years ago may need another look. BIS and DDTC have both stepped up enforcement, particularly around sensitive destinations and advanced technology. As controls on areas like advanced computing widen (see The New Iron Curtain Is Made of Silicon), more products sit in the gray zone where jurisdiction has to be reasoned out case by case.

ITAR vs EAR quick reference

Frequently asked questions

How do I know if my product is ITAR or EAR?

Check the U.S. Munitions List (22 CFR 121.1) first. If your product, its technical data or a related service is described there, including as a part or component “specially designed” for a listed defense article, it is ITAR. If it is not on the USML, it generally falls under the EAR, where you check the 600 series first and then the rest of the CCL to find an ECCN or confirm EAR99.

Does selling to a military make my product ITAR?

No. Note 2 to 22 CFR 120.3 says the intended use after export, military or civilian, is not by itself a factor in ITAR jurisdiction. Militaries routinely buy commercial, EAR-controlled items such as ruggedized laptops, sensors and communications gear. Ask what the item was designed to do.

What is a Commodity Jurisdiction (CJ) determination?

A CJ determination is DDTC’s official ruling on whether an item is ITAR or EAR. You file Form DS-4076 electronically through DECCS (no DDTC registration needed), and include a preliminary determination and rationale. It binds only the item as described, so a design change can undo it.

What does it cost to misclassify ITAR vs EAR?

Shipping an ITAR item as EAR risks civil penalties currently up to $1,271,078 per violation or twice the transaction value (22 CFR 127.10), criminal penalties up to $1 million and 20 years per violation (22 U.S.C. 2778(c)), and debarment, for every affected shipment. Treating an EAR item as ITAR is legal, but it costs DDTC registration fees from $3,000 a year (22 CFR 122.3), lost markets and customers, and needless restrictions.

Do I have to file a CJ if I’m unsure whether my product is ITAR?

No. You can perform and document your own jurisdiction analysis and operate on it. File a CJ when you genuinely can’t resolve the question, or when you want a binding government answer for a high-stakes item. Either way, write down your reasoning.

Where TariffWolf fits

Under-controlling risks a compliance catastrophe, and over-controlling taxes your competitiveness. Getting the answer right starts with classification. It’s what TariffWolf does: export-control classification that reasons clearly about where an item sits, with a human in the loop and a record you can defend.

Don’t take our word for it. Don’t Trust Us. Try Us.

This article is for general information and is not legal advice. Penalty amounts are adjusted for inflation and change, and export controls and the USML/CCL shift over time. Verify against the current ITAR, EAR and DDTC/BIS guidance, or consult qualified export-control counsel for specific products.