Many of the submissions we prepare for clients have a question about ITAR/EAR compliance, and it’s a question that is unfamiliar to many emerging/startup companies. But the answer is an important one for the government to know. Equally as important is knowing how to answer it.

Two federal regulations

The acronym “ITAR/EAR” refers to two separate federal regulations, the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). In combination, these two federal regulations govern our country’s export laws, specifically those affecting the manufacturing, sales, and distribution of technology to other countries. These two regulations exist in parallel, but they serve the same essential purpose: To control access to certain types of American-developed technology. 

ITAR is focused on defense-related military items and articles. This regulation includes the United States Munition List (USML), which has 21 different categories from firearms and munitions to biological agents, nuclear warfare, and personal protective equipment (PPE). A subcategory of the items included in the USML are considered Significant Military Equipment (SME), which have additional defense trade controls.

The focus of EAR is similar but applies to dual-use technologies that can be used by defense customers but also can be sold in the non-defense commercial marketplace. EAR also includes its own list, known as the Commerce Control List (CCL) with 10 different categories. Each category is then divided into five different subgroups.   

Becoming compliant

If your company is developing a technology and you are responding to a federal solicitation, or if you become a subcontractor on a federal contract, the government wants to know that your company will comply with the requirements of ITAR/EAR. 

Though this varies from client to client and by technology or product, we will use standard boilerplate language in preparing your submission that states that you intend to comply.  This applies to companies that intend to supply a product as well as those that supply technologies like software or training. Any company that receives funding through the SBIR program or similar types of programs is also required to register if exporting is part of your business.


If your company is developing a technology that falls under ITAR and you are responding to a federal submission, there are some important steps to take. For companies that fall under the ITAR umbrella, you will work with the U.S. Department of State.

  1. You will start by creating an account at the U.S. Department of State Defense Export Control and Compliance System’s DECCS Industry Service Portal.
  2. This allows your company to register with the U.S. State Department under ITAR Part 122. This is done through the Directorate of Defense Trade Controls via this portal. This is done electronically and the DDTC will review the application. The average review time is about 45 days. Once it has been approved, a registration fee must be paid. The current cost of the first tier (first year) registration is $2,250 and it is good for one year. 
  3. Once this payment is processed, you will receive an electronic registration letter. Your company will also be assigned a unique registration code. This code will either start with an M (for manufacturers or exporters) or a K (for brokers), followed by four or five digits. DECCS recommends being judicious about the use of this code. 


If your company’s technology is considered dual use, you will work with the Department of Commerce. If the product or service you provide falls into one of the CCL categories, it can be identified by an Export Control Classification Number (ECCN). If you plan to export it, you will work with the Bureau of Industry and Security (BIS), which is part of the Department of Commerce to obtain a license.  In this instance, you will create a SNAP-R account at the BIS website. This process will issue you a Company Identification Number and ultimately, you will use this to obtain an export license.

There is no formal certification process currently in place to prove compliance for ITAR or EAR. Companies that engage in these activities are expected to understand if the product they produce falls under the jurisdiction of either ITAR or EAR. However, there are significant penalties for non-compliance.