Encryption Export Controls Guide: Wassenaar, EAR Category 5 Part 2 and EU Dual-Use

Almost every security product ships cryptography, and that makes it a dual-use item under export control law, whether it is a hardware security module, a VPN client, a secrets manager or an agent that signs its own tokens. The controls come from the Wassenaar Arrangement's Category 5 Part 2 (Information Security) and are implemented nationally: in the United States by the Export Administration Regulations (EAR) and in the EU by Regulation (EU) 2021/821. Most commercial products end up exportable with little friction, but only after a classification decision, sometimes a filing, and an annual report. This guide is for product, engineering and trade compliance teams at vendors that build or ship crypto, and for security teams moving keys, code and tools across borders. Status line: based on the eCFR, BIS, EUR-Lex, European Commission and Wassenaar pages read on 27 October 2026.

Key takeaways

• Classification comes first. Work out whether an item is in Category 5 Part 2 at all: the decontrol notes to ECCN 5A002.a remove many products whose crypto is limited to things like smart cards, banking, OAM on routers or general-purpose operating systems.
• Mass market is the common path. Items meeting the Cryptography Note (Note 3) move to 5A992 or 5D992 and out of the encryption licensing section 15 CFR 742.15; some still need a self-classification report.
• License Exception ENC covers most of the rest. BIS states there is no "unexportable" level of encryption under ENC; the work is the right paragraph of 740.17, a 30-day wait where a classification request is needed, and reporting.
• Two US reporting dates matter. The annual self-classification report and the second semiannual sales report are both due by 1 February; the first semiannual report is due by 1 August.
• EU rules are similar but enforced nationally. Regulation 2021/821 treats electronic transmission of software and technology as an export, offers a Union general export authorisation for encryption, and leaves penalties to Member States.

Scope: who and what is covered

The Wassenaar Arrangement maintains the multilateral Dual-Use List; its current version reflects amendments agreed up to the December 2025 Plenary. Participating states transpose it, which is why ECCN numbers match across the US and EU lists. BIS describes Category 5 Part 2 as covering three families.

What is an export: under the EU Regulation (Art. 2(2)), export includes transmitting software or technology by electronic media, fax or telephone to a destination outside the EU, and making it available electronically to persons outside the EU. The EAR also controls reexports and in-country transfers, and releases of technology or source code to foreign persons. Who is an exporter: for electronic transmissions in the EU, the person who decides to transmit or make the software or technology available (Art. 2(3)). What is outside the EAR: publicly available encryption source code classified 5D002 is not subject to the EAR, subject to a notification for non-standard cryptography (742.15(b)). Items under another agency's exclusive jurisdiction, such as certain ITAR USML categories, are outside the BIS encryption guidance.

Decontrol notes to 5A002.a

BIS lists ten notes under which an item is not classified in 5A002.a. If one applies, check the rest of Category 5 Part 2 and other categories; if nothing else describes the item, it can be EAR99.

BIS FAQs add two traps: OAM does not include network security monitoring or forensics, and a product is classified on its own functionality, not by the classification of an encryption library it embeds.

Key obligations

United States: EAR

• Licence baseline: 742.15(a)(1) requires a licence for 5A002, 5A004, parts of 5D002 and 5E002 technology to all destinations except Canada, which is why ENC matters so much.
• Destinations: ENC does not authorise exports, reexports or transfers to Country Groups E:1 or E:2.
• End-use limits: under 740.17(f), ENC is not available for cryptanalytic items, certain network penetration tools or certain automated vulnerability tools if you know or have reason to know they will be used to affect systems without authorisation.
• Requests for information: during a classification request, BIS can ask for more information; you have 14 days, extendable by 14, and time on hold does not count toward the 30 days.
• Reliance: resellers can rely on a producer's self-classification or CCATS; a new classification is needed when cryptographic functionality changes, not for ordinary patches or renaming (BIS FAQs).

European Union: Regulation (EU) 2021/821

• Authorisation: exports of Annex I items need authorisation (Art. 3). Art. 12 provides individual, global, national general and Union general export authorisations; individual and global authorisations are generally valid for up to two years, large projects up to four.
• Union general export authorisations: the Commission lists eight, including exports to Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, Liechtenstein, the UK and the USA, intra-group technology transfers, and encryption. Each has its own conditions and registration rules set nationally.
• Catch-all and cyber-surveillance: Art. 4 catches non-listed items when authorities inform you of WMD or certain military end uses; Art. 5 catches non-listed cyber-surveillance items that may be used for internal repression or serious human rights violations, with Member States reviewing notified cases within 30 working days, extendable by 30.
• Intra-EU: only Annex IV items need authorisation for transfers within the EU (Art. 11), and Art. 11(8) lets Member States require more information on certain Category 5 Part 2 transfers.
• Records: keep export records for at least five years from the end of the calendar year of export, and intra-EU transfer records for at least three (Art. 27).

Timeline and current status

Control lists change every year after the Wassenaar Plenary. Re-check classifications when a new US rule or EU delegated regulation lands, especially if the 2026 EU update has entered into force by the time you read this.

Enforcement and penalties

Civil penalty levels are set by regulation and adjusted over time, so check current figures. BIS weighs cooperation and mitigating factors, which is why a working compliance programme and prompt voluntary self-disclosure matter.

What it means for AI agents and non-human identities

• Keys and certificates are not the item, but the software is: shipping a secrets manager, workload identity agent or HSM client that encrypts data is an export of a Category 5 Part 2 item. Classify the agent binaries and SDKs like any other product. See the Cryptographic Key Management Guide.
• Your crypto inventory doubles as classification evidence: a cryptographic bill of materials showing algorithms, key lengths and whether crypto is user-modifiable answers most classification questions. See the Cryptographic Inventory and CBOM Guide.
• Automated distribution is still export: CI/CD pipelines, package registries and update services that push encrypting software abroad export it. Put destination screening and the classification record in the release pipeline, and restrict pipeline credentials so a bot cannot publish to a blocked region.
• AI coding agents and non-standard crypto: an agent that adds a custom cipher or modifies a library's crypto can move a product from mass market into 740.17(b)(3) "non-standard cryptography". Gate crypto changes behind human review and trigger re-classification.
• Offensive tooling: vulnerability analysis, forensics and penetration tools sit in ENC (b)(3) and the 740.17(f) end-use limits, which matters for red team agents and AI security testing products.
• Post-quantum changes: replacing algorithms with ML-KEM or ML-DSA is a change of cryptographic functionality that may need a fresh classification. See the Post-Quantum Cryptography Migration Guide.

Compliance steps

1. Inventory products and their crypto. For each product and version: algorithms, key lengths, protocols, whether crypto protects data or only OAM and authentication, and whether users can change it.
2. Screen for "not subject to" and decontrols. Check public availability of source code and the 5A002.a decontrol notes before anything else.
3. Test against Note 3. Decide mass market status and record the reasoning; resellers will ask for it.
4. Pick the ENC paragraph. (a), (b)(1), (b)(2) or (b)(3); file classification requests where needed and wait 30 days before shipping outside the immediate-export cases.
5. Map the EU route. Identify the Member State of the exporter, check whether the encryption or intra-group Union general authorisation fits, and register as that authorisation requires.
6. Build it into release. Attach ECCN and authorisation to each build; block release when crypto changes until re-classified. Pilot with one product line before rolling across the portfolio.
7. Report. Diarise 1 February and 1 August for semiannual reports, and 1 February for the annual self-classification report, where a "no change" email is allowed only if no new products became eligible that year.
8. Screen parties and destinations. Country Groups E:1 and E:2, sanctioned parties, and more sensitive government end users.
9. Keep records and train. Five years for EU exports; engineering and sales must know what triggers re-classification.

Decision guidance

Detection, measurement and framework mapping

• Coverage: percentage of shipped products and versions with a recorded ECCN and authorisation basis.
• Drift: crypto changes merged without a re-classification review, target zero.
• Reporting: reports filed by 1 February and 1 August.
• Screening: percentage of orders and downloads screened against destination and party rules.
• Cycle time: days from classification request to authorisation.

Common failure patterns

• Classify once, ship forever: crypto changes in later versions never trigger re-classification.
• Library equals product: assuming an embedded open source library's status covers the product, which BIS FAQs reject.
• Forgotten electronic exports: treating downloads, repository pushes and email of source code as outside export control.
• Missed 1 February: no annual self-classification report, including the required "no change" email.
• OAM over-reach: claiming the router OAM note for products that also do data-plane encryption or security monitoring.
• Security tools treated as ordinary software: forensics and penetration tools shipped without considering ENC (b)(3) and the end-use limits.

Practitioner checklist

• Record algorithms, key lengths and crypto purpose for every product and version.
• Check public availability and the 5A002.a decontrol notes before classifying.
• Document Note 3 mass market reasoning where it is claimed.
• Choose and record the ENC paragraph or licence basis for each item.
• File classification requests and respect the 30-day wait where required.
• Diarise the 1 February and 1 August reports; a "no change" email applies only to the annual self-classification report.
• Map EU exports to an authorisation type and keep records for five years.
• Gate crypto code changes, including AI-generated ones, behind re-classification review.
• Screen destinations, parties and end uses in sales and release pipelines.

Standards and references

• eCFR: 15 CFR 740.17, Encryption commodities, software and technology (ENC)
• eCFR: 15 CFR 742.15, Encryption items
• BIS: Encryption Controls
• BIS: Encryption decontrol notes
• EUR-Lex: Regulation (EU) 2021/821 on dual-use items
• European Commission: Exporting dual-use items
• Wassenaar Arrangement: Control Lists
• US Code: 50 U.S.C. 4819, Penalties

This guide summarises the Wassenaar Category 5 Part 2 controls, the EAR encryption rules and Regulation (EU) 2021/821 as published by official sources when read on 27 October 2026, and is not legal advice. Related NHI Mgmt Group resources: Encryption Guide · Cryptographic Inventory and CBOM Guide · Software Supply Chain Security Guide · Regulations and Frameworks Guide