Dual use software: Understanding key export requirements

Dual use software refers to programs and code that have been developed for legitimate commercial or civilian purposes, but which could also be applied in military, defence or security contexts. Because of this potential for misuse, such software is treated as a regulated good and falls under the same export control frameworks as physical dual use items.

Software may be considered dual use when it includes capabilities such as:

• Strong cryptography or encryption functions
• Intrusion, surveillance or cyber monitoring features
• Simulation tools used in aerospace, nuclear or defence modelling
• Navigation, guidance or geospatial analysis components
• Artificial intelligence or machine learning models with security applications

For example, computational fluid dynamics software used by commercial aerospace engineers can also model missile aerodynamics, while penetration testing tools designed to help businesses identify network vulnerabilities can be repurposed to launch cyber attacks against critical infrastructure.

Without proper controls, these products could enable hostile states to advance weapons programs or carry out targeted surveillance on dissidents and journalists.

In the US, dual use software is primarily regulated under the Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS). Software with controlled functionality is listed on the Commerce Control List (CCL), with Category 5 Part 2 covering information security products such as encryption software. 

To comply with these rules, exporters must determine whether their products fall into these categories and, if so, assign the correct Export Control Classification Number (ECCN) and secure a license where required before proceeding with any exports.

In the EU, dual use software is governed by Regulation 2021/821, which sets out a common control list applied across all member states. This includes specific entries for cyber-surveillance items, cryptographic software and technology supporting weapons of mass destruction.

Penalties for non-compliance are severe. In the US, breaches can result in fines of up to $300,000 per violation or twice the transaction value, alongside criminal prosecution. EU penalties vary by member state but commonly include substantial fines, loss of export privileges and imprisonment.

These controls are not limited to physical shipments of products containing dual use software. They apply equally to intangible transfers, including downloads, cloud access, email attachments and even technical support provided remotely. This means a single email sharing controlled code with an overseas colleague, or granting a foreign national access to a server, can constitute an export under both US and EU rules.

Managing dual use software compliance manually is increasingly impractical given the volume of transactions, the complexity of overlapping regulations and the speed at which digital transfers take place. Effective trade and customs compliance software helps exporters stay on top of their obligations by automating key processes and reducing the risk of costly errors.

When looking for solutions that can help streamline processes related to dual use software compliance, firms should consider tools that can:

• Ensure correct classification of software against the CCL, EU dual use list and other relevant control lists.
• Screen transactions against denied party lists to prevent shipments to sanctioned entities or restricted end users.
• Manage licenses and track usage against approved volumes or values.
• Maintain full audit trails for both physical exports and intangible transfers.

By centralizing these processes within a single platform, exporters can demonstrate due diligence, respond quickly to regulatory changes and protect themselves from the financial and reputational damage of non-compliance.

While there are internationally-agreed guidelines for export control classifications, each territory will have its own specific legislation governing the classification of exported goods, so it’s essential exporters familiarize themselves with local rules.

For exports from the US, items will require a five-character alphanumeric code known as an Export Control Classification Number (ECCN). To locate this, exporters should refer to the Commerce Control List (CCL) for any and all terms that describe the details of the product, taking care to be as specific as possible.

For items shipped from EU countries, there are EU-wide regulations governing export control classification, though specific controls in relation to military items are determined by each member state. Licensing is handled by national authorities, such as BAFA in Germany and SBDU in France.