The Export Administration Regulations govern the dual-use world: commercial items with military applications, controlled by Commerce instead of State. Different list, different rules, and one encryption provision that changes everything about how you store it.
ITAR is the State Department's regime: defense articles and services on the U.S. Munitions List, administered by DDTC. EAR belongs to Commerce's Bureau of Industry and Security: dual-use items on the Commerce Control List, each with an ECCN, and the broad EAR99 category for items not specifically listed.
The line matters because the obligations differ: licensing, permitted destinations, deemed-export handling, and recordkeeping all follow the list your item sits on. Plenty of companies handle both, an ITAR program for the defense work and EAR controls for the dual-use catalog, and the classification call in between is where mistakes get expensive.
Under 15 CFR §734.18, unclassified technical data secured end to end with FIPS 140 validated cryptographic modules, and not intentionally stored in embargoed destinations, is not treated as an export in transmission and storage.
Since 2020, §120.54 gives ITAR technical data an equivalent path: properly end-to-end encrypted data in transit is not an export event. Two regimes, one architectural answer.
The carve-outs reward exactly one design: data encrypted the whole way, access controlled by user, and storage locations you can prove. That is the RegDOX architecture, not a configuration you assemble.
Dual-regime companies run one enclave for both datasets, with need-to-know permissioning keeping each program's data where its rules require.
Regulatory provisions summarized for orientation, not legal advice. Classification and licensing decisions remain yours.
Bring your product catalog and your questions. We’ll walk through which regime owns what, and where the carve-outs can work for you.
(800) 517-3171 · Nashua, NH · U.S. data centers & personnel