EAR 101: Staying compliant when your customer isn't the only one you need to screen

A company shipped a product to a legitimate, fully vetted customer. The sale itself checked out, the customer was a real business with a real order. What nobody caught was what happened after delivery, when that customer quietly re-exported the product to an end user on a restricted list. The original shipment was clean. The compliance exposure showed up two steps downstream, in a transaction the exporting company never directly controlled but was still held accountable for.

This guide breaks down what the Export Administration Regulations actually require, where compliance programs tend to break down, and what a program built to survive real scrutiny looks like.

What the EAR actually is

The Export Administration Regulations govern the export, re-export, and transfer of most commercial items with potential military, security, or strategic applications, administered by the Commerce Department's Bureau of Industry and Security.

How EAR differs from ITAR

• The EAR covers dual-use items, products with both civilian and potential military applications, along with purely commercial goods that still carry export controls.

• ITAR, by contrast, covers inherently military and defense-related items, administered separately by the State Department.

• A single company can fall under both frameworks simultaneously if its product line spans commercial and defense-adjacent categories, which is exactly where a lot of classification confusion starts.

Who actually has to comply

The EAR applies to a wider range of businesses than most companies initially assume, covering not just direct exporters but manufacturers, distributors, and even companies providing technical support or software updates to customers abroad.

Export classification, and why it's where most exposure starts

Every item subject to the EAR gets classified against the Commerce Control List, and that classification decision drives everything else in the compliance process.

• An Export Control Classification Number, or ECCN, determines what licensing requirements apply and to which destinations.

• Items not specifically listed often default to a catch-all classification, EAR99, though this doesn't automatically mean no restrictions apply.

• Misclassifying a product, treating a controlled item as EAR99 or assigning the wrong ECCN, is one of the most common starting points for a serious compliance gap.

Why classification mistakes compound over time

A wrong classification made once tends to get reused across every future shipment of that product, meaning a single early mistake can end up affecting years of transactions before anyone catches it. That's part of why a classification error often surfaces as a much larger problem than it originally was.

The screening obligations companies underestimate

Classification is only the first layer. The EAR also requires screening the parties involved in a transaction, and this is where a lot of companies underestimate the scope of what's actually required.

Restricted party screening

• Denied party lists, maintained by BIS and other federal agencies, identify individuals and entities barred from receiving US exports.

• Screening has to cover not just the direct customer, but known intermediaries, distributors, and, where reasonably knowable, downstream end users.

• Red flags around end use, an unusual order pattern, a request to strip identifying markings, or a shipping route that doesn't match the stated destination can trigger a duty to investigate further before proceeding.

Deemed exports

• A deemed export occurs when controlled technology or technical data is shared with a foreign national, even entirely within the United States, such as inside a company's own office or lab.

• This catches a lot of companies off guard, since it means an export control issue can exist without any physical shipment ever crossing a border.

• Hiring or assigning a foreign national employee to work with controlled technology can itself require a license, depending on their country of origin and the technology involved.

Why so many EAR violations start as classification or screening gaps

Most EAR enforcement doesn't involve companies deliberately evading export controls. It involves gaps in process that only become visible after a shipment or transfer already happened.

• A product classified once, years ago, and never re-evaluated as its specifications or use cases evolved.

• Restricted party screening run at initial customer onboarding but never repeated for follow-on orders from the same customer.

• A foreign national employee granted access to controlled technical data without anyone checking whether that access itself required a license.

• Re-export risk ignored entirely, on the assumption that once a product left US hands, it was somebody else's compliance problem.

None of these require intent to violate the law. They require a compliance process built for the moment of initial sale, without accounting for how classification, personnel, and downstream transactions all change over time.

How EAR issues actually surface

EAR problems rarely surface through a routine internal audit. They tend to show up through channels that carry real regulatory weight.

• Self-disclosure, when a company identifies a violation internally and reports it to BIS, often results in more favorable treatment than if the issue is found independently.

• BIS audits, which can be triggered by a specific concern or as part of a broader industry review.

• Whistleblower tips, frequently from employees who noticed a screening step being skipped or a shipment routed in a way that didn't match its stated destination.

• Re-export chains that unravel during an unrelated investigation, when a downstream diversion gets discovered and traced back to the original exporting company.

That last pathway deserves particular attention, since it means a company can face scrutiny years after a transaction closed, triggered by something entirely outside its own visibility at the time.

What a real BIS investigation or audit actually looks like

When BIS conducts a review, it's checking whether a company's actual practices match what export control compliance genuinely requires, not just whether a policy document exists.

Expect a review of classification decisions against the actual technical specifications of the products involved, not just the classification originally assigned. Expect scrutiny of screening records, checking whether restricted party lists were actually checked at each relevant point in the transaction, not just once at initial onboarding. Expect questions about deemed export controls, particularly for companies with foreign national employees working on technical projects. And expect a close look at how the company handled any prior red flags, since an ignored warning sign tends to weigh heavily once a violation is confirmed.

The pillars of an export compliance program that holds up

A program built to survive real BIS scrutiny treats classification and screening as ongoing discipline, not a one-time step completed at initial product launch or customer onboarding.

• Classification review that gets revisited as products evolve, not assigned once and assumed permanent.

• Restricted party screening applied consistently, at initial onboarding and at every subsequent transaction, not just the first one.

• Deemed export controls that account for foreign national employees and contractors before they're granted access to controlled technology.

• Recordkeeping detailed enough to demonstrate, after the fact, exactly what screening and classification steps were actually taken.

Running these pillars as a coordinated program, rather than separate checklists owned by sales, HR, and legal independently, takes real structure. A Certified Compliance Professional credential gives export compliance staff a framework for tying classification, screening, and deemed export controls together, instead of managing each in isolation. Teams building or maintaining the systems behind restricted party screening and transaction monitoring also benefit from Tech Certifications that go beyond a basic screening software walkthrough.

Mistakes companies keep making

A handful of patterns show up repeatedly in BIS enforcement actions and voluntary disclosures.

• Deemed exports overlooked entirely, with companies focused on physical shipments while missing technology access happening inside their own walls.

• Re-export screening skipped on the assumption that a foreign customer's downstream sales aren't the exporting company's responsibility.

• Classification decisions made once and never revisited, even as a product's technical specifications or use cases shift over time.

• Red flags noticed but not escalated, because the person who spotted them wasn't sure whether it was actually their responsibility to act.

Communicating export control obligations clearly to sales and customer-facing teams, who often drive the transactions where these gaps first appear, is its own challenge. A Digital Marketing Course helps compliance teams translate dense regulatory requirements into training that sales teams actually retain, instead of a policy document reviewed once during onboarding and never again.

What getting it wrong actually costs, beyond the fine

An EAR violation carries consequences that extend well past the initial financial penalty.

• Denial of export privileges can cut a company off from international markets entirely, sometimes for years.

• Criminal liability can extend to individual employees and executives in cases involving willful violations, not just the company as an entity.

• Reputational damage with international customers and partners can outlast the legal resolution, particularly for companies competing in security-sensitive industries.

• Corrective action requirements can impose years of ongoing compliance oversight, adding sustained operational cost beyond the original penalty.

Where EAR enforcement is heading

A few shifts are worth watching. Technology-specific controls are tightening sharply around AI systems and advanced semiconductors, categories that didn't carry the same level of scrutiny a few years ago. Country-based restrictions keep expanding and shifting, requiring compliance teams to track geopolitical changes far more closely than a static classification approach allows. Companies adopting automated screening and classification tools are finding Deep Tech Certifications cover infrastructure that standard export compliance training doesn't reach. And enforcement continues to extend to smaller exporters and technology companies who previously assumed EAR obligations were mostly a defense-industry concern.

Conclusion

EAR compliance comes down to a pattern that's easy to underestimate: most violations don't come from a company deliberately evading export controls; they come from a classification made once and never revisited, or a screening step that covered the initial sale but missed everything downstream. The Commerce Control List and ECCN system set the classification framework, but the real strength of a compliance program shows up in the discipline behind it, screening applied consistently across every transaction, deemed export controls that catch technology access before it happens, and recordkeeping detailed enough to prove what was actually checked. Get that right, and EAR compliance becomes routine operational discipline. Get it wrong, and the gap tends to surface exactly when a re-export, an audit, or a whistleblower forces the question.

FAQs

What are the Export Administration Regulations?

Federal rules governing the export, re-export, and transfer of commercial items with potential military or strategic applications.

Who enforces the EAR?

The Commerce Department's Bureau of Industry and Security, commonly referred to as BIS.

How does the EAR differ from ITAR?

The EAR covers dual-use and commercial items, while ITAR covers inherently military and defense-related items under the State Department.

What is an ECCN?

An Export Control Classification Number determining what licensing requirements apply to an item and its destination.

What is EAR99?

A catch-all classification for items not specifically listed on the Commerce Control List, though restrictions can still apply.

What is restricted party screening?

Checking transaction parties against denied party lists to ensure exports aren't going to barred individuals or entities.

Does screening need to cover more than the direct customer?

Yes, it should extend to known intermediaries and, where reasonably knowable, downstream end users.

What is a deemed export?

Sharing controlled technology or technical data with a foreign national, even entirely within the United States.

Can a foreign national employee trigger an export control issue?

Yes, granting them access to controlled technology can require a license depending on their country of origin.

What are common end-use red flags?

Unusual order patterns, requests to remove identifying markings, or shipping routes inconsistent with the stated destination.

Why do classification mistakes tend to compound over time?

A wrong classification often gets reused across future shipments, turning one error into a much larger pattern.

How do EAR violations typically get discovered?

Through self-disclosure, BIS audits, whistleblower tips, or re-export chains uncovered during unrelated investigations.

What is self-disclosure, and does it help a company facing exposure?

Voluntarily reporting a violation to BIS, which often results in more favorable treatment than independent discovery.

What does a BIS investigation typically review?

Classification decisions, screening records, deemed export controls, and how prior red flags were handled.

Can a company be responsible for a customer's re-export of its product?

Yes, a company can face exposure if a downstream re-export diverts its product to a restricted end user.

What are the consequences of denial of export privileges?

A company can be cut off from international markets entirely, sometimes for an extended period.

Can individuals face criminal liability under the EAR?

Yes, willful violations can result in personal criminal liability for employees and executives, not just the company.

How are AI and semiconductor controls changing under the EAR?

Technology-specific restrictions are tightening sharply as these categories draw increased strategic scrutiny.

How often should export classifications be reviewed?

Whenever a product's technical specifications or use cases change, not just once at initial launch.

What's the most common EAR compliance mistake?

Overlooking deemed exports, focusing on physical shipments while missing technology access happening internally.