ITAR 101: What defense-adjacent businesses actually need to get right on export compliance

The booth was busy and the demo was going well. A visitor asked how the sensor handled extreme heat, and the engineer, happy to talk shop, pulled up the specs and walked through the tolerances. Two other people leaned in to listen. Nobody asked where they were from. Nobody thought they needed to.

That conversation may have just been an export.

Under the International Traffic in Arms Regulations, or ITAR, sharing technical data about defense-related items with a foreign person can count as an export. It can happen inside a US convention center. It can happen out loud or on a screen. Nothing has to be shipped. The rules cover defense articles, defense services, and technical data, and they follow that information wherever it travels: an email attachment, a shared drive, a cloud server, a chat over coffee.

Most companies that get into trouble aren't careless. They just never realized the rules applied to something so ordinary.

This guide walks through what ITAR requires, who it applies to, and what a compliance program looks like when it has to hold up under real scrutiny.

What ITAR actually is

ITAR is a set of US federal regulations controlling the export and temporary import of defense-related items and technical data. It exists to prevent sensitive military and defense technology from reaching foreign adversaries, and it's enforced by the State Department's Directorate of Defense Trade Controls.

The regulation applies to items on something called the US Munitions List, which covers far more than finished weapons. Components, software, technical drawings, and even certain services tied to defense applications can fall under ITAR, which is exactly why companies that don't think of themselves as defense contractors often discover, sometimes the hard way, that they're subject to it anyway.

Why ITAR compliance matters more right now

A few trends have raised the stakes for companies operating anywhere near this space.

• Enforcement has intensified, with regulators pursuing smaller and mid-sized companies, not just major defense primes.

• Technology sectors that never considered themselves defense-adjacent, aerospace startups, advanced software companies, robotics firms, increasingly find their products touch ITAR-controlled categories.

• Geopolitical tension has tightened export control generally, meaning gray areas that might have been overlooked a decade ago now draw closer scrutiny.

None of this means the underlying rules changed dramatically overnight. It means far more companies are now within ITAR's reach than they realize.

What counts as a defense article or technical data

The US Munitions List defines what's actually controlled under ITAR, and its scope regularly surprises companies encountering it for the first time.

Defense articles include obvious things like weapons and munitions, but also components, parts, and accessories designed specifically for military use, even ones that look mundane on their own. Technical data is just as tightly controlled and covers information required to design, develop, produce, or use a defense article, including drawings, blueprints, source code, and even detailed verbal explanations in some cases.

This is where companies get caught off guard most often. A part that seems purely commercial can still fall under ITAR if it was specifically designed or modified for a military application, and technical data doesn't have to physically leave the country to count as an export.

Who needs to register and get licensed?

Any US company or individual that manufactures, exports, or brokers defense articles or defense services generally needs to register with the Directorate of Defense Trade Controls, regardless of whether they've actually exported anything yet. Registration itself doesn't grant permission to export; it's a prerequisite that opens the door to applying for the specific licenses needed for actual export activity.

This requirement catches a surprising range of businesses: component manufacturers who have no direct relationship with the military, software companies whose code ends up embedded in a defense system, and even companies that only provide technical consulting related to a controlled item.

Deemed exports: the part that catches companies off guard

This is one of the most commonly misunderstood parts of ITAR, and it deserves real attention.

A deemed export happens when controlled technical data is shared with a foreign national, even if that sharing happens entirely within the US and nothing physically crosses a border. Handing an engineering drawing to a foreign national employee, discussing controlled technical details in a meeting where a foreign national is present, or giving system access to a contractor who isn't a US citizen can all count as an export under ITAR, triggering the same licensing requirements as if the information had been physically shipped overseas.

This catches companies off guard constantly, particularly fast-growing tech companies hiring internationally without realizing their engineering data is subject to export controls the moment a foreign national employee gains access to it.

The core pillars of an ITAR compliance program

A real ITAR program isn't a policy sitting in a compliance manual nobody reads. It's a set of operational controls that actually function day to day.

Registration comes first, and has to stay current as the business changes. Classification is next, meaning a clear, documented determination of whether a specific product, component, or piece of technical data actually falls under ITAR, since getting this wrong at the start undermines everything built on top of it. Access controls restrict who can see or handle controlled technical data, specifically addressing the deemed export risk that catches so many companies. Licensing covers the actual permissions required before any controlled export activity happens, whether that's a physical shipment or sharing data with a foreign national employee. And recordkeeping ties it together, since ITAR requires detailed records of export activity, classifications, and licenses that have to hold up if a compliance review happens.

Common red flags and compliance gaps

A few patterns show up again and again in ITAR enforcement actions and internal audits.

• Products or technical data never formally classified, leaving the company unsure whether ITAR even applies until a problem surfaces.

• Foreign national employees or contractors given broad system access without any review of what controlled data they can reach.

• Technical discussions happening in meetings, emails, or shared documents without considering who's actually in the room or on the thread.

• Shipments made without confirming license requirements first, sometimes because a product's classification was assumed rather than actually determined.

• Recordkeeping gaps that make it hard to reconstruct what was exported, to whom, and under what authority.

None of these individually looks like a crisis. Together, they're exactly the pattern an investigation is built to surface.

Building an ITAR program that holds up

A program built to survive scrutiny starts with an honest classification review of every product, component, and piece of technical data the company handles, not an assumption that ITAR doesn't apply. From there, a few things matter most.

Access to controlled technical data needs to be restricted based on nationality, not just general role-based permissions, since a typical access control system built for cybersecurity purposes usually isn't built with deemed exports in mind. Training has to reach engineers and technical staff specifically, since they're the ones most likely to inadvertently trigger a deemed export through an email, a meeting, or a shared file. And licensing decisions need a clear internal process, so a shipment or a hire doesn't happen before someone has actually confirmed what's required.

Building this kind of program well takes real structure, and formal training helps compliance and export control staff build that structure with an actual framework instead of assembling one reactively. A Certified Compliance Management Professional credential is worth looking into for staff responsible for running an export control program, since export compliance benefits enormously from the kind of structured, cross-functional approach that credential is built around. And since ITAR training only works if engineers and staff actually absorb it rather than skimming a slide deck once a year, a Digital Marketing Course can help compliance teams communicate these requirements in a way that actually lands, rather than reading as another ignored policy memo. 

Common mistakes companies make

A handful of mistakes keep showing up. Assuming ITAR doesn't apply because the company doesn't see itself as a defense contractor, when a single component or piece of technical data can be enough to trigger coverage. Treating deemed exports as a theoretical risk rather than an operational one, particularly at companies hiring engineering talent internationally without adjusting data access accordingly. And weak recordkeeping that leaves a company unable to demonstrate compliance clearly if a review happens, even when the underlying decisions were reasonable at the time.

Technical staff and engineers working with sensitive systems also benefit from genuine technical grounding around how access controls and classification actually function in practice, and Tech Certifications helps compliance-adjacent technical staff understand the systems they're responsible for controlling access to, rather than relying entirely on IT to interpret export requirements they weren't trained to consider.

The cost of getting it wrong

ITAR violations carry some of the most severe penalties in the entire compliance landscape. Civil penalties can run into significant sums per violation, and criminal violations can bring substantial fines alongside real prison time for individuals involved. Beyond direct penalties, a company found in violation can lose its export privileges entirely, which for a defense-adjacent business can be functionally catastrophic, cutting off international revenue and reputation with defense customers overnight.

Where ITAR enforcement is heading

Technology and software companies are drawing closer scrutiny as more commercial innovation touches dual-use and defense-relevant applications. AI and advanced computing specifically are becoming a growing enforcement focus, as regulators work to understand how these technologies intersect with existing export control categories. Companies building or evaluating the infrastructure behind controlled technical systems benefit from real depth here, and Deep Tech Certifications is worth exploring for teams navigating that overlap directly. And as export enforcement continues tightening, companies hiring internationally need export control review built into onboarding, not treated as an afterthought once a hire is already made. 

Conclusion

ITAR compliance comes down to a demanding but straightforward responsibility: know exactly what you're handling, know exactly who can access it, and get permission before anything controlled crosses a border, physical or otherwise. The complexity lives in the details: correctly classifying products and data, controlling access based on nationality rather than just role, and keeping records thorough enough to prove compliance if it's ever challenged. Most violations aren't the result of deliberate evasion; they're the result of a classification nobody checked, a foreign national hire nobody flagged, an email nobody thought twice about. Get the fundamentals right, and ITAR compliance becomes a disciplined, manageable part of doing business. Get them wrong, and the consequences reach further and hit harder than almost any other compliance failure a company can make.

FAQs

What does ITAR stand for?

International Traffic in Arms Regulations, a US federal law controlling the export of defense-related articles and technical data.

Who enforces ITAR?

The State Department's Directorate of Defense Trade Controls oversees ITAR registration, licensing, and enforcement.

What is the US Munitions List?

A list defining the categories of defense articles, services, and technical data controlled under ITAR.

Does ITAR only apply to weapons manufacturers?

No, it can apply to components, software, technical data, and services connected to defense applications, even from non-defense companies.

What counts as technical data under ITAR?

Information required to design, develop, produce, or use a defense article, including drawings, blueprints, and source code.

Does technical data have to leave the country to count as an export?

No, sharing it with a foreign national within the US can still count as an export under the deemed export rule.

What is a deemed export?

Sharing controlled technical data with a foreign national, even domestically, which triggers the same licensing requirements as a physical export.

Who needs to register under ITAR?

Any US company or individual that manufactures, exports, or brokers defense articles or defense services.

Does registering under ITAR mean a company can export freely?

No, registration is a prerequisite, but specific export activity still requires separate licensing.

Can a commercial product fall under ITAR?

Yes, if it was specifically designed or modified for a military application, even if it looks purely commercial otherwise.

What triggers a deemed export risk in hiring?

Giving a foreign national employee or contractor access to controlled technical data or systems.

What recordkeeping does ITAR require?

Detailed records of export activity, classifications, and licenses that can be produced if a compliance review happens.

What happens if a company misclassifies a product under ITAR?

It risks exporting or sharing controlled items without the required license, which can trigger serious violations.

What are the penalties for ITAR violations?

Civil penalties can be substantial per violation, and criminal violations can bring significant fines and prison time.

Can a company lose its ability to export after an ITAR violation?

Yes, violations can result in the loss of export privileges entirely, which can be severely damaging for defense-adjacent businesses.

Are startups and small companies subject to ITAR?

Yes, enforcement increasingly targets smaller and mid-sized companies, not just major defense contractors.

How does AI intersect with ITAR?

Advanced computing and AI are drawing growing scrutiny as regulators assess how these technologies fit existing export control categories.

What is the most common ITAR compliance mistake?

Assuming ITAR doesn't apply because a company doesn't see itself as a defense contractor.

How should companies handle ITAR training for engineers?

Training needs to reach technical staff specifically, since they're most likely to trigger a deemed export unintentionally.

What's the first step in building an ITAR compliance program?

An honest classification review of every product, component, and piece of technical data the company handles.