EU dual-use export controls: a primer for tech startups
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
If your startup builds encryption, sensors, high-performance computing, drones, or software with security applications, EU dual-use export controls may apply to what you ship, license, or email. Dual-use items are goods, software, and technology designed for civilian use that can also serve military or security purposes. This primer explains the core obligations, how classification works, and where export control intersects with the compliance systems you already run. It is educational, not legal advice.
What the rules cover
The main instrument is Regulation (EU) 2021/821, the recast Dual-Use Regulation. It controls the export of listed items out of the EU, and it also reaches brokering, technical assistance, and transit in defined cases. Annex I lists the controlled items across ten categories, from nuclear materials to telecommunications and information security. The list is long and technical, and it changes as the underlying international regimes update it.
For a software or hardware startup, the categories that come up most often are Category 4 (computers), Category 5 Part 1 (telecommunications), and Category 5 Part 2 (information security, which captures many cryptographic products). If your product uses strong encryption, assume you need to check Category 5 Part 2 before you export.
Classification comes first
You cannot decide whether you need a licence until you know your item's Export Control Classification Number, or ECCN equivalent under Annex I. Classification means matching your product's technical parameters against the list entries. This is a factual exercise, not a judgement call. Encryption strength, data rates, processing performance, and intended function all determine whether an item is listed.
Three outcomes are possible. The item is listed, so a licence is likely required. The item is not listed but may be caught by the catch-all provisions (for example, where you know it is intended for a weapons programme). Or the item is not controlled at all. Document the classification and keep the evidence. A regulator or a consortium partner will ask how you reached the conclusion.
Licensing basics
If an item is controlled, you export it under a licence. The EU offers several types. Individual licences cover a specific exporter, item, and destination. Global licences cover multiple destinations or customers for a defined exporter. General export authorisations (EUGEAs) are published, standing authorisations for lower-risk destinations, subject to conditions. You apply to the competent authority of the Member State where you are established, and processing times vary.
Note that transferring technology or source code to a person outside the EU can count as an export, including by email, cloud access, or a shared repository. This is the point most software teams miss. Access controls and hosting location matter here.
Where export control meets your compliance programme
Export control is not a standalone silo. It draws on the same document control, training records, and audit trails that a quality management system already maintains. If you run a QMS structured around ISO 9001, you already have the process discipline to record classifications, control document versions, and evidence decisions. Extending that structure to export control avoids building a parallel system.
Access management is the other overlap. Because releasing controlled technology to a non-EU person is an export, tenant isolation and hosting location become compliance-relevant. ComplyTrain runs on a silo model, schema-per-tenant, Cognito-pool-per-tenant, and bucket-per-tenant, with EU hosting on AWS eu-central-1 in Frankfurt. That keeps controlled technical data within a known jurisdiction and under defined access controls.
For teams handling sensitive documentation, the document vault uses post-quantum cryptography in its PKI, so records retain confidentiality against future decryption risk.
A practical starting sequence
Start by inventorying your products, software, and technical documentation. Classify each against Annex I and record the result. Map who has access to controlled technology, including contractors and cloud services outside the EU. Identify your competent authority and the licence types that fit your export patterns. Build training so staff recognise a controlled transfer before it happens, not after.
Our consultancy offers fixed-price packages that combine the platform with Skylen experts who take you through certification from any starting point. Read more about a QMS built around ISO 9001 at our ISO 9001 overview, or see how the platform supports information security work at our ISO 27001 page. Book a call with our team to scope an export control compliance programme that fits your startup.