Almost every security product ships cryptography, and that makes it a dual-use item under export control law, whether it is a hardware security module, a VPN client, a secrets manager or an agent that signs its own tokens. The controls come from the Wassenaar Arrangement's Category 5 Part 2 (Information Security) and are implemented nationally: in the United States by the Export Administration Regulations (EAR) and in the EU by Regulation (EU) 2021/821. Most commercial products end up exportable with little friction, but only after a classification decision, sometimes a filing, and an annual report. This guide is for product, engineering and trade compliance teams at vendors that build or ship crypto, and for security teams moving keys, code and tools across borders. Status line: based on the eCFR, BIS, EUR-Lex, European Commission and Wassenaar pages read on 27 October 2026.
Key takeaways
- Classification comes first. Work out whether an item is in Category 5 Part 2 at all: the decontrol notes to ECCN 5A002.a remove many products whose crypto is limited to things like smart cards, banking, OAM on routers or general-purpose operating systems.
- Mass market is the common path. Items meeting the Cryptography Note (Note 3) move to 5A992 or 5D992 and out of the encryption licensing section 15 CFR 742.15; some still need a self-classification report.
- License Exception ENC covers most of the rest. BIS states there is no "unexportable" level of encryption under ENC; the work is the right paragraph of 740.17, a 30-day wait where a classification request is needed, and reporting.
- Two US reporting dates matter. The annual self-classification report and the second semiannual sales report are both due by 1 February; the first semiannual report is due by 1 August.
- EU rules are similar but enforced nationally. Regulation 2021/821 treats electronic transmission of software and technology as an export, offers a Union general export authorisation for encryption, and leaves penalties to Member States.
Scope: who and what is covered
The Wassenaar Arrangement maintains the multilateral Dual-Use List; its current version reflects amendments agreed up to the December 2025 Plenary. Participating states transpose it, which is why ECCN numbers match across the US and EU lists. BIS describes Category 5 Part 2 as covering three families.
| Family | Typical entries | Examples of what lands here |
|---|---|---|
| Cryptographic information security | 5A002, 5B002, 5D002, 5E002 (multilateral); 5A992.c, 5D992.c, 5E992.b (US unilateral, mass market) | VPN gateways, HSMs, encrypting storage, TLS libraries, secrets managers, secure messaging |
| Non-cryptographic information security | 5A003 | Certain non-cryptographic security items listed by the regime |
| Defeating, weakening or bypassing information security | 5A004 | Cryptanalytic items and certain tools that defeat protections |
What is an export: under the EU Regulation (Art. 2(2)), export includes transmitting software or technology by electronic media, fax or telephone to a destination outside the EU, and making it available electronically to persons outside the EU. The EAR also controls reexports and in-country transfers, and releases of technology or source code to foreign persons. Who is an exporter: for electronic transmissions in the EU, the person who decides to transmit or make the software or technology available (Art. 2(3)). What is outside the EAR: publicly available encryption source code classified 5D002 is not subject to the EAR, subject to a notification for non-standard cryptography (742.15(b)). Items under another agency's exclusive jurisdiction, such as certain ITAR USML categories, are outside the BIS encryption guidance.
Decontrol notes to 5A002.a
BIS lists ten notes under which an item is not classified in 5A002.a. If one applies, check the rest of Category 5 Part 2 and other categories; if nothing else describes the item, it can be EAR99.
| Note | Covers | Security product relevance |
|---|---|---|
| (a) | Smart cards, e-documents and their readers/writers, restricted or protecting stored personal data | Badge and ID card systems |
| (b) | Cryptographic equipment specially designed for banking or money transactions | Payment terminals |
| (h) | Routers, switches and relays whose security is limited to Operations, Administration or Maintenance (OAM) | Management-plane SSH and SNMPv3 only; data-plane crypto does not qualify |
| (i) | General-purpose computing equipment and servers where crypto is integral to a qualifying CPU or a non-5D002 operating system, or limited to OAM | Standard servers and OS-provided crypto |
| (j) | Connected civil industry applications limited to non-arbitrary data, OAM or a specific civil use | Many IoT endpoints; BIS FAQs apply it to some single board computers |
| (c) to (g) | Civil mobile phones, cordless phones, civil radios, personal area networks, small civil RAN equipment, each with stated limits | Mostly telecom hardware |
BIS FAQs add two traps: OAM does not include network security monitoring or forensics, and a product is classified on its own functionality, not by the classification of an encryption library it embeds.
Key obligations
United States: EAR
| Path | What it covers | What you must do | Reference |
|---|---|---|---|
| Not subject to the EAR | Publicly available 5D002 source code | For non-standard cryptography only, email the URL or a copy to [email protected] and [email protected], and again if the URL or crypto functionality changes | 742.15(b) |
| Mass market | Items meeting Note 3, classified 5A992 or 5D992 | Self-classify; file the annual self-classification report where 740.17(b)(1) requires it | 742.15(a)(1), 740.17(b)(1) |
| ENC (a) | Internal development or production by private sector end users headquartered in Supplement 3 countries; transfers to US subsidiaries and their foreign national employees, contractors and interns; unchanged US components in foreign products | No classification request or reporting | 740.17(a)(1) to (a)(3) |
| ENC (b)(1) | Self-classified 5A002.a, z.1, 5B002 and related 5D002 not in (b)(2) or (b)(3) | Immediate authorisation with an annual self-classification report | 740.17(b)(1), (e)(3) |
| ENC (b)(2) | Specified more sensitive items | Classification request; authorisation 30 days after submission; semiannual sales reports | 740.17(b)(2), (d), (e)(1) |
| ENC (b)(3) | Non-mass-market components and toolkits, non-standard cryptography, vulnerability analysis and forensics tools, cryptographic activation items | Classification request; authorisation 30 days after submission, to any end user | 740.17(b)(3) |
| Licence or ELA | Items not eligible for ENC, or more sensitive government end users | Individual licence, or an Encryption Licensing Arrangement valid for four years | 742.15(a) |
- Licence baseline: 742.15(a)(1) requires a licence for 5A002, 5A004, parts of 5D002 and 5E002 technology to all destinations except Canada, which is why ENC matters so much.
- Destinations: ENC does not authorise exports, reexports or transfers to Country Groups E:1 or E:2.
- End-use limits: under 740.17(f), ENC is not available for cryptanalytic items, certain network penetration tools or certain automated vulnerability tools if you know or have reason to know they will be used to affect systems without authorisation.
- Requests for information: during a classification request, BIS can ask for more information; you have 14 days, extendable by 14, and time on hold does not count toward the 30 days.
- Reliance: resellers can rely on a producer's self-classification or CCATS; a new classification is needed when cryptographic functionality changes, not for ordinary patches or renaming (BIS FAQs).
European Union: Regulation (EU) 2021/821
- Authorisation: exports of Annex I items need authorisation (Art. 3). Art. 12 provides individual, global, national general and Union general export authorisations; individual and global authorisations are generally valid for up to two years, large projects up to four.
- Union general export authorisations: the Commission lists eight, including exports to Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, Liechtenstein, the UK and the USA, intra-group technology transfers, and encryption. Each has its own conditions and registration rules set nationally.
- Catch-all and cyber-surveillance: Art. 4 catches non-listed items when authorities inform you of WMD or certain military end uses; Art. 5 catches non-listed cyber-surveillance items that may be used for internal repression or serious human rights violations, with Member States reviewing notified cases within 30 working days, extendable by 30.
- Intra-EU: only Annex IV items need authorisation for transfers within the EU (Art. 11), and Art. 11(8) lets Member States require more information on certain Category 5 Part 2 transfers.
- Records: keep export records for at least five years from the end of the calendar year of export, and intra-EU transfer records for at least three (Art. 27).
Timeline and current status
| Date | Event | Source |
|---|---|---|
| 29 March 2021 | BIS rule implementing the Wassenaar 2019 Plenary changes to ENC and 742.15 (86 FR 16488) | BIS encryption page; eCFR 742.15 |
| 20 May 2021 | Regulation (EU) 2021/821 adopted, recasting Regulation (EC) No 428/2009 | EUR-Lex |
| 9 September 2021 | Regulation (EU) 2021/821 applies | EUR-Lex |
| September 2025 | Delegated Regulation (EU) 2025/2003 updates Annex I | European Commission |
| December 2025 | Wassenaar Plenary; current list WA-LIST (25) 1 Corr. reflects it | Wassenaar Arrangement |
| 14 September 2026 | Commission adopts the 2026 Annex I update; it enters into force on publication after a two-month scrutiny period | European Commission |
| Every 1 February and 1 August | US annual self-classification report (1 February) and semiannual sales reports (1 February and 1 August) | 740.17(e) |
Control lists change every year after the Wassenaar Plenary. Re-check classifications when a new US rule or EU delegated regulation lands, especially if the 2026 EU update has entered into force by the time you read this.
Enforcement and penalties
| Regime | Penalty | Source |
|---|---|---|
| US criminal | For wilful violations, a fine of up to $1,000,000 and, for individuals, up to 20 years' imprisonment, or both | 50 U.S.C. 4819(b) |
| US civil | Per violation, up to $300,000 or twice the value of the transaction, whichever is greater; licence revocation; prohibition on exporting | 50 U.S.C. 4819(c) |
| US denial | Export privileges may be denied for up to 10 years after certain convictions, extending to related parties | 50 U.S.C. 4819(e) |
| EU | Set by each Member State; must be effective, proportionate and dissuasive | Reg. 2021/821 Art. 25 |
Civil penalty levels are set by regulation and adjusted over time, so check current figures. BIS weighs cooperation and mitigating factors, which is why a working compliance programme and prompt voluntary self-disclosure matter.
What it means for AI agents and non-human identities
- Keys and certificates are not the item, but the software is: shipping a secrets manager, workload identity agent or HSM client that encrypts data is an export of a Category 5 Part 2 item. Classify the agent binaries and SDKs like any other product. See the Cryptographic Key Management Guide.
- Your crypto inventory doubles as classification evidence: a cryptographic bill of materials showing algorithms, key lengths and whether crypto is user-modifiable answers most classification questions. See the Cryptographic Inventory and CBOM Guide.
- Automated distribution is still export: CI/CD pipelines, package registries and update services that push encrypting software abroad export it. Put destination screening and the classification record in the release pipeline, and restrict pipeline credentials so a bot cannot publish to a blocked region.
- AI coding agents and non-standard crypto: an agent that adds a custom cipher or modifies a library's crypto can move a product from mass market into 740.17(b)(3) "non-standard cryptography". Gate crypto changes behind human review and trigger re-classification.
- Offensive tooling: vulnerability analysis, forensics and penetration tools sit in ENC (b)(3) and the 740.17(f) end-use limits, which matters for red team agents and AI security testing products.
- Post-quantum changes: replacing algorithms with ML-KEM or ML-DSA is a change of cryptographic functionality that may need a fresh classification. See the Post-Quantum Cryptography Migration Guide.
Compliance steps
- Inventory products and their crypto. For each product and version: algorithms, key lengths, protocols, whether crypto protects data or only OAM and authentication, and whether users can change it.
- Screen for "not subject to" and decontrols. Check public availability of source code and the 5A002.a decontrol notes before anything else.
- Test against Note 3. Decide mass market status and record the reasoning; resellers will ask for it.
- Pick the ENC paragraph. (a), (b)(1), (b)(2) or (b)(3); file classification requests where needed and wait 30 days before shipping outside the immediate-export cases.
- Map the EU route. Identify the Member State of the exporter, check whether the encryption or intra-group Union general authorisation fits, and register as that authorisation requires.
- Build it into release. Attach ECCN and authorisation to each build; block release when crypto changes until re-classified. Pilot with one product line before rolling across the portfolio.
- Report. Diarise 1 February and 1 August for semiannual reports, and 1 February for the annual self-classification report, where a "no change" email is allowed only if no new products became eligible that year.
- Screen parties and destinations. Country Groups E:1 and E:2, sanctioned parties, and more sensitive government end users.
- Keep records and train. Five years for EU exports; engineering and sales must know what triggers re-classification.
Decision guidance
| Situation | Likely route | Trade-off |
|---|---|---|
| Open source library with standard algorithms | Publicly available, not subject to the EAR, no notification | Commercial builds you ship are still classified separately |
| Commercial SaaS agent or client sold at retail | Mass market self-classification | Low effort, but you own the reasoning if challenged |
| HSM, high-throughput VPN, crypto toolkit | ENC (b)(2) or (b)(3) with a classification request | 30-day wait and semiannual reporting |
| Sales to foreign defence or intelligence bodies | Licence or ELA | Longest lead time; plan early |
| Small vendor, one product | Manual classification record and calendar | Simple, but fragile when staff change |
| Large vendor, many SKUs | Classification in PLM or build metadata with automated screening | Up-front tooling cost |
Detection, measurement and framework mapping
- Coverage: percentage of shipped products and versions with a recorded ECCN and authorisation basis.
- Drift: crypto changes merged without a re-classification review, target zero.
- Reporting: reports filed by 1 February and 1 August.
- Screening: percentage of orders and downloads screened against destination and party rules.
- Cycle time: days from classification request to authorisation.
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-03 | Legal and regulatory requirements, including export control, are understood and managed |
| NIST CSF 2.0 | ID.AM-02 | Software inventory that records crypto components |
| NIST SP 800-53 Rev 5 | SC-13, SC-12 | Cryptographic protection and key management records that also feed classification |
| NIST SP 800-53 Rev 5 | SR-3, CM-8 | Supply chain controls and component inventory used as classification evidence |
Common failure patterns
- Classify once, ship forever: crypto changes in later versions never trigger re-classification.
- Library equals product: assuming an embedded open source library's status covers the product, which BIS FAQs reject.
- Forgotten electronic exports: treating downloads, repository pushes and email of source code as outside export control.
- Missed 1 February: no annual self-classification report, including the required "no change" email.
- OAM over-reach: claiming the router OAM note for products that also do data-plane encryption or security monitoring.
- Security tools treated as ordinary software: forensics and penetration tools shipped without considering ENC (b)(3) and the end-use limits.
Practitioner checklist
- Record algorithms, key lengths and crypto purpose for every product and version.
- Check public availability and the 5A002.a decontrol notes before classifying.
- Document Note 3 mass market reasoning where it is claimed.
- Choose and record the ENC paragraph or licence basis for each item.
- File classification requests and respect the 30-day wait where required.
- Diarise the 1 February and 1 August reports; a "no change" email applies only to the annual self-classification report.
- Map EU exports to an authorisation type and keep records for five years.
- Gate crypto code changes, including AI-generated ones, behind re-classification review.
- Screen destinations, parties and end uses in sales and release pipelines.
Standards and references
- eCFR: 15 CFR 740.17, Encryption commodities, software and technology (ENC)
- eCFR: 15 CFR 742.15, Encryption items
- BIS: Encryption Controls
- BIS: Encryption decontrol notes
- EUR-Lex: Regulation (EU) 2021/821 on dual-use items
- European Commission: Exporting dual-use items
- Wassenaar Arrangement: Control Lists
- US Code: 50 U.S.C. 4819, Penalties
This guide summarises the Wassenaar Category 5 Part 2 controls, the EAR encryption rules and Regulation (EU) 2021/821 as published by official sources when read on 27 October 2026, and is not legal advice. Related NHI Mgmt Group resources: Encryption Guide · Cryptographic Inventory and CBOM Guide · Software Supply Chain Security Guide · Regulations and Frameworks Guide