ECCN: classifying your product before somebody else does it for you

An ECCN — export control classification number — identifies where an item sits on the United States Commerce Control List, and from that follows almost everything else: whether an export licence is required, to which countries, for which end uses and end users, and which exceptions may apply. It is a five-character code, and determining it is the exporter’s responsibility, not the freight forwarder’s.

The default answer people reach for is EAR99, the residual category for items subject to the Export Administration Regulations but not listed on the Control List. Most commercial goods genuinely are EAR99. The problem is arriving there by assumption rather than by classification, because EAR99 still carries restrictions by destination, end user and end use — and because encryption, sensors, materials and software surprise people constantly.

How classification is actually determined

• By the product’s technical characteristics against the Control List categories, not by what it is used for commercially.
• By the exporter, through self-classification, or by requesting a formal determination from the regulator where the answer is genuinely unclear.
• From the manufacturer, where you are reselling — but a supplier’s statement is a starting point to verify, not an answer to adopt. Suppliers get this wrong too.
• Per item, and revisited when the product changes. A firmware update adding encryption can move a product onto the list.
• With the reasoning recorded. The classification itself is a conclusion; the file that shows how you reached it is what an audit examines.

EAR99 is not a free pass

Items classified EAR99 can still require a licence — for embargoed destinations, for a party on a restricted list, or where the exporter knows or has reason to know of a prohibited end use such as certain weapons or unsafeguarded nuclear activity. That last category is the one that catches ordinary companies: the classification is fine, the destination is fine, and the customer is on a list nobody checked. Classification and screening are two separate obligations, and doing one well does not cover the other.

Encryption is where commercial software companies most often discover they are in scope. Products with encryption functionality can fall under specific Control List entries with their own notification and reporting requirements, even when the company thinks of itself as selling an ordinary business application.

Keeping classifications defensible

What matters is not only the code but the record: which version of the product, who classified it, on what basis, on what date, and what the supplier said if you relied on them. Ettex Records holds that file per product with the review date visible, Ettex Sheets carries the product-to-ECCN matrix used by the shipping team, and the screening obligation that runs alongside it is covered in denied party screening.

Being direct: this is records, not export compliance software, and none of it is legal advice. Classification is a technical and legal exercise with severe penalties for error; specialist counsel and dedicated classification tools exist for exactly this, and any product near encryption, sensors, aerospace or dual-use materials warrants them.