Expertise · Export control
Export control: knowing what you actually ship, and under which regime
The question is not whether your products are sensitive. It is whether you can demonstrate it — item by item, destination by destination — and whether your organisation notices when the answer changes.
Export control is the field where the gap between perception and reality is widest. Many industrial companies assume it does not concern them because they make neither weapons nor security equipment. But control lists target technical characteristics, not sectors: a bearing, a sensor, a machine tool, an alloy, control software or plain technical documentation can fall within Annex I without anything in their commercial use suggesting it.
The second gap concerns the nature of the obligation. It is not enough to be off the list: catch-all clauses require you to refrain or to seek authorisation once you are aware — or are informed by the authority — of a problematic end use. That obligation rests on what you know, and therefore on what your organisation is able to see.
Step 1 — Classify the products, without grey areas
Classification against control lists is a technical exercise that must be run with the people who know the product, not only with commercial documents. It turns on the parameters actually listed: accuracy, frequency range, thermal resistance, purity, processing capacity, presence of cryptography.
Three categories are systematically forgotten in a first classification pass: embedded software, technology — technical documentation, drawings, assistance and know-how transferred — and spare parts shipped to after-sales, usually treated as a logistics flow with no regulatory review.
- Classification of products, software and technology against Annex I of Regulation (EU) 2021/821 and, where relevant, Annex IV for intra-EU transfers.
- Determination of US ECCNs and assessment of extraterritorial exposure: US content, foreign direct product rules, re-exports.
- Qualification under Swiss law: Goods Control Ordinance annexes, specific military goods, non-listed goods subject to authorisation.
- Traceability: who classified, from which datasheet, on what date, and what event must trigger review.
Step 2 — Obtain the right authorisations
The type of authorisation you choose determines your administrative burden for years. A Union general export authorisation covers certain item/destination pairs without individual application, but imposes registration and reporting conditions. A global licence offers flexibility but presupposes a credible internal compliance programme. An individual licence is heavy but sometimes the only route.
| Situation | Usual route | What it demands of you |
|---|---|---|
| Recurring flow, low-sensitivity destination | EU general export authorisation | Prior registration, conditions of use, reporting |
| Broad portfolio, several destinations | Global licence | Documented and audited internal compliance programme |
| One-off operation or sensitive destination | Individual licence | Full technical file, end-use certificate |
| Non-listed item, doubt on end use | Consult the authority / catch-all | Written record of the signals detected and the decision |
| Technology transfer to a subsidiary | Authorisation covering intangible transfer | Access mapping, control of file sharing |
The gap discovered too late
Intangible technology transfer — a drawing emailed, access to a design server, remote intervention on a machine, an engineer presenting know-how during a visit — is an export under the regulation. In an organisation where R&D collaborates daily with non-EU sites, this is usually the first real hole in the framework, and it appears in no logistics system.
Step 3 — An internal compliance programme that holds
An ICP is not a document: it is a framework whose operation can be demonstrated. The European Commission set out the expected elements in Recommendation (EU) 2019/1318, and that framework has become the de facto reference — including for authorities assessing a global licence application.
We build these to the size of the company. A 200-person business does not need the structure of a listed group; it needs seven or eight control steps to be genuinely performed, and to be able to prove it.
- Written, circulated management commitment with named responsibilities.
- Organisation and resources: who decides, who checks, who can stop a shipment.
- Product classification and its update procedure.
- Party and destination screening, connected to the sanctions framework.
- End-use assessment and handling of red flags.
- Record keeping for the required retention period.
- Targeted training for exposed functions: sales, order management, R&D, purchasing, IT.
- Internal audit, treatment of deviations and incident escalation.
The link with sanctions
Export control and sanctions are two distinct regimes that produce a single operational act: deciding whether a shipment leaves. Splitting them across two procedures owned by two departments is the most frequent failure mode we observe — a product not listed as dual-use but caught by a sectoral restriction, or a perfectly eligible customer owned by a designated entity. We handle both dimensions in one exit control, with a single record.
See also
Our dedicated sanctions and embargoes practice covers party screening, the ownership rule and circumvention due diligence.
Deliverables
What the engagement produces
Export classification matrix
Per item or family: EU dual-use status, ECCN where relevant, Swiss status, triggering parameter and technical source.
Sensitive flow map
Destinations, end users, channels — including technology transfers and after-sales flows.
Licensing strategy
The right licence type per flow, with its administrative cost and processing timeline.
ICP manual
Procedures, control forms, responsibility matrix, training plan and internal audit template.
End-use assessment template
The questions to ask, the red flags to document, and what to do when doubt arises.
Operational training
Half a day per exposed population, on your own cases, not on generic examples.
Method
Typical sequence
Frame the exposure
Review of the product portfolio, destinations and channels. Identify the flows that genuinely expose the company if mishandled.
Classify
Technical work with R&D and engineering. Classification is co-signed, dated and sourced.
Choose the licensing route
A reasoned choice between general, global and individual authorisation, driven by volume and acceptable workload.
Install the framework
Draft the ICP, embed controls in existing processes, train, then dry-run on real shipments.
Frequently asked questions
What is a dual-use item, in practice?
A dual-use item is a product, software or technology capable of both civil and military use, or of contributing to proliferation. In the EU these items are listed in Annex I to Regulation (EU) 2021/821, organised into ten categories from nuclear materials to aerospace, via electronics, sensors, lasers and information security. Listing turns on precise technical parameters: the same type of equipment may be controlled above a performance threshold and free below it. That is why classification requires the datasheet, not the sales catalogue.
Does US law apply to a French or Swiss company?
It can, and this is routinely underestimated outside the United States. The EAR follows the goods: a US-origin item, an item incorporating more than a de minimis threshold of controlled US content, or an item made abroad using certain US technology or equipment may remain subject to US authorisation on re-export, even between two third countries. We assess that exposure and, where it is material, direct you to counsel admitted to practise in the US for positions governed by US law.
Is the Swiss regime aligned with the EU?
It is comparable in logic and largely aligned with the international control regimes' lists, but it is an autonomous legal order: the Goods Control Act and Ordinance, the War Material Act, and a licensing procedure run by SECO with its own forms and timelines. A Swiss company cannot simply apply the European grid, and a group established on both sides must maintain both qualifications in parallel for the same part number.
Do we need an ICP if our volumes are small?
The formal requirement depends on the licence type: a documented ICP is expected in practice for global licences and strongly advisable beyond. But the decisive argument is not administrative. Catch-all clauses place the obligation on what the exporter knows or ought to have known; without an organised detection framework, a company must demonstrate diligence with no record at all. A proportionate framework, even a light one, changes that position entirely.
Is software or a drawing sent by email in scope?
Yes. Transmitting technology or software electronically — email, server access, code repository, remote support — is an export. That includes making a design document available to a non-EU subsidiary, granting a non-EU national access to controlled files, or remote maintenance on a machine installed abroad. It is the part of the framework that most often escapes logistics controls, since no goods cross a border.