Building an Export Compliance Program (ECP): A Management System for EAR and ITAR

Use export control basics and license determination to connect item classification with destination, end-user and end-use checks.

Do I need a written export compliance program if I only ship a few controlled items?

Yes, if you export, reexport, or transfer items subject to the EAR or ITAR, regardless of volume. BIS treats the absence of an export compliance program as an aggravating factor in penalty cases, and DDTC expects ITAR registrants to maintain a written compliance program; the program is what turns reasonable export controls from individual heroics into a repeatable system.

GingerControl's Export Control Classifier reads a product's datasheet, narrows the Commerce Control List (Categories 0 to 9) to one ECCN, or EAR99 when no entry applies, and writes a research report your auditors and counsel can check. It works under the EAR only: the ITAR jurisdiction review, restricted-party screening and license decisions sit outside it, with your counsel and a screening tool. The exporter and their counsel make the commodity-jurisdiction call, the legal determination, and the filing; the classifier's report is research underneath those decisions, not a substitute for DDTC registration or legal advice. This article maps the export administration regulations and ITAR requirements onto one management system so a program owner can stand it up element by element, then link down to the item-level mechanics where each step gets done.

An export compliance program is a management system, not a binder

Most teams meet "itar compliance" and EAR obligations the same way: a strong classification analyst, a screening tool someone logs into, and a shared drive of license copies. That works until the analyst leaves, the tool license lapses, or a CBP or BIS auditor asks for the trail behind a shipment from eighteen months ago. An export compliance program exists so the answer does not depend on one person's memory.

The two U.S. agencies expect a program, not just correct individual transactions:

• BIS (Commerce, EAR) publishes the Core Elements of an Effective Export Management and Compliance Program (EMCP), the long-standing nine-element framework, and consolidates the same expectations into an eight-grouping Export Compliance Program (ECP) guide. BIS describes an ECP as "a series of procedures and tools that facilitate compliance with export controls to mitigate the risk of export violations."
• DDTC (State, ITAR) issued its ITAR Compliance Program Guidelines on December 5, 2022, setting out the elements of an effective ITAR Compliance Program (ICP) and the related due-diligence best practices.

The two frameworks are not identical, but they overlap heavily, and a single program can satisfy both if it is structured around the shared elements rather than maintained as two separate binders. The rest of this article treats the EMCP nine elements as the spine, folds the ITAR-specific obligations into each one, and points to the item-level guides where each element actually gets executed.

How you tool the screening-and-documentation layer underneath the program shapes how many of those elements you can actually satisfy on demand. The table below compares three approaches a program owner is choosing between, by what each one does for the EMCP elements.

Bottom line: For an export compliance program owner standing up ITAR and EAR governance with limited headcount, the classification and screening layer is not a side tool; it decides whether elements 2, 3, 4, 6, 7, and 8 share one record or live in separate places that drift apart. Run the ITAR jurisdiction review first with counsel, classify the EAR items with a tool that writes its reasoning down, and screen parties in a dedicated screening tool; a bare code lookup leaves no reasoning, and a spreadsheet leaves your audit and recordkeeping elements dependent on one analyst's memory. The commodity-jurisdiction call, the legal determination, and any filing remain yours and your counsel's in every case.

Quotable insight: The most expensive export-control failures are not classification errors; they are governance gaps. A company can classify every item correctly and still draw a penalty because no element of its export compliance program assigned ownership, set a training cadence, or preserved the reasoning trail, so when BIS or DDTC asks "show me the program," the answer is a person, not a system. The EMCP nine elements exist precisely to convert correct individual decisions into a defensible management system that survives staff turnover and a five-year audit lookback.

The nine EMCP elements, mapped to EAR and ITAR

BIS's Core Elements of an Effective EMCP name nine elements. The table below states each element, what it requires under the EAR, and the ITAR-specific obligation that rides alongside it, per the DDTC ITAR Compliance Program Guidelines. The last column shows where GingerControl's Export Control Classifier fits, which is mostly the classification element; the determination and filing stay with you and your counsel.

Bottom line: For an export compliance program owner standing up ITAR and EAR governance at the same time, the practical move is to build one management system on the EMCP nine elements and fold the ITAR-specific obligations into each element, rather than running two parallel binders that drift apart. Item classification feeds elements 2, 3, 4, 7, and 8, so it needs a written reasoning record; a bare ECCN lookup leaves no reasoning trail for the recordkeeping and audit elements, and neither a lookup nor GingerControl's Export Control Classifier tells you when an item is ITAR.

BIS's consolidated eight-grouping ECP guide covers the same ground with the headings management commitment, risk assessments, export authorization, recordkeeping, training, audits, export violations and corrective actions, and building and maintaining your ECP. Whether you label your program with nine elements or eight groupings is a documentation choice, not a substantive one; the obligations underneath are the same.

How does an export compliance program handle ITAR requirements differently from the EAR?

ITAR adds three obligations the EAR does not, and they bolt onto specific EMCP elements rather than forming a separate program.

Registration is a precondition (element 1, management commitment). Any U.S. person who manufactures, exports, or temporarily imports defense articles or furnishes defense services must register with DDTC, even if they never actually export. Registration is annual via the Statement of Registration (Form DS-2032), and under the December 10, 2024 final rule the Tier 1 fee is $3,000 per year, the first increase in fifteen years. Registration is a prerequisite for any DDTC license. The export administration regulations impose no equivalent registration step.

Technical data and deemed exports run hot (elements 2 and 6). Releasing ITAR-controlled technical data to a foreign person, including inside the United States, is a deemed export. That makes access controls over engineering data, source code, and design documents a core part of the program, not an IT afterthought.

Voluntary disclosure has its own rail (element 8). ITAR violations are disclosed under 22 CFR 127.12, which DDTC may treat as a mitigating factor in any administrative penalty. The disclosure requires a thorough review of the circumstances, the corrective actions taken, and a certification from a senior official. The EAR has its own Voluntary Self-Disclosure rail to BIS. The program element is the same (detect, investigate, escalate, disclose), but the agency, the rule, and the form differ depending on whether the item was ITAR or EAR.

The jurisdiction question is what decides which rail you are on, and it has to be answered before classification. If you are still working out whether a given item is ITAR or EAR, that determination governs everything downstream in your program; our companion guide walks the order of review in detail in ITAR vs EAR: which set of export controls actually governs your product.

GingerControl's Export Control Classifier covers the EAR step of that order of review: once ITAR jurisdiction is ruled out, it narrows the CCL to one ECCN, or EAR99, from the product's controlled parameters and writes a report. It does not review ITAR jurisdiction, register your company with DDTC, make the commodity-jurisdiction call, or file a disclosure. Those remain the exporter's and counsel's responsibility.

A program owner's build sequence

You do not stand up nine elements at once. The sequence below front-loads the elements that reduce the most risk per week of effort, which matters when the program owner is one person with a day job.

1. Name the owner and get the signed commitment (element 1). A program with no named owner and no senior-executive sign-off fails the first question every auditor asks. For ITAR registrants, this is also where the Compliance Management Commitment Statement lives.
2. Run the jurisdiction-and-classification pass on your existing catalog (elements 2 and 3). Before you write a single procedure, find out what you actually ship. This is where you separate USML items from CCL items from EAR99, and where most surprises surface. The mechanics of the EAR side are covered in how to find your ECCN number and EAR99 explained; the deeper ECCN walkthrough is in ECCN classification under the EAR.
3. Stand up screening at the transaction point (element 6). Restricted-party and end-use screening is the control that catches the denied customer before the shipment leaves. The full screening playbook is in restricted-party and denied-party screening.
4. Write the recordkeeping rule and turn it on (element 4). Both regimes require a five-year retention window. Decide where the reasoning trail lives and make it automatic, not a quarterly cleanup.
5. Set the training cadence (element 5), then the audit cadence (element 7). Recurring, role-based, and documented. An audit you cannot reproduce is not an audit.
6. Write the escalation and disclosure procedure last (elements 8 and 9). You hope never to use it, but it is the element BIS and DDTC weigh most heavily when something goes wrong, because a voluntary disclosure is a mitigating factor only if you have a process to make one.

Use denied-party and sanctions screening program design to set the screening cadence, escalation rules and evidence trail.

If you are deciding whether to build this in-house, bring in outside help, or run a hybrid, our companion piece on when to hire an ITAR consultant covers the build-versus-buy decision for the program itself.

GingerControl's Export Control Classifier supports the classification in step 3 and the classification record behind 4, 7, and 8, so those records are written when the item is classified rather than reconstructed later. The commodity-jurisdiction determination, the legal call, the DDTC registration, and any filing or disclosure stay with you and your counsel.

Why the recordkeeping and audit elements are where programs actually fail

Classification gets the attention, but the elements that decide a penalty case are usually recordkeeping (element 4) and monitoring/auditing (element 7). Both the EAR five-year retention rule (15 CFR Part 762) and the ITAR five-year rule (22 CFR 122.5) mean the record you need to defend a shipment may sit untouched for years before anyone asks for it. A program that classifies correctly but cannot reconstruct why, who decided, against which control parameters, and what screening returned, has the right answer and no defense.

This is also where a voluntary self-disclosure either comes together or collapses. A VSD under 22 CFR 127.12 (ITAR) or the EAR equivalent rests on a factual record: what shipped, under what classification, screened against what lists, with what reasoning. If that record exists as a byproduct of the screening element, assembling a disclosure is a retrieval task. If it does not, it is a forensic reconstruction under deadline pressure, exactly when you least want one.

Classification reports make the item-level part of elements 4, 7, and 8 cheaper to satisfy: each one records the control parameters evaluated and why candidate ECCNs were kept or ruled out, so the record is built once and retrieved later. The disclosure decision itself, and whether to file, remains a legal judgment for the exporter and counsel.

GingerControl’s Export Control Classifier supplies EAR/CCL classification research and a written explanation. It does not determine ITAR commodity jurisdiction, file BIS or DDTC applications, or provide legal advice. The exporter owns the export-control determination, access controls, licensing analysis and any required filing, with counsel or qualified specialists assisting as needed. CBP customs-broker rulings on import classifications do not establish a professional-licensing rule for these export-control decisions.

Frequently asked questions

What is the difference between an EMCP and an ECP?

They name the same thing. EMCP (Export Management and Compliance Program) is the title of BIS's long-standing nine-element guidance; ECP (Export Compliance Program) is the heading BIS uses for its consolidated eight-grouping guide. The underlying obligations (classification, screening, recordkeeping, disclosure) are identical regardless of which label your written program uses; for a team standing up its first program, pick one framework and document against it consistently.

Does an export compliance program have to cover both EAR and ITAR?

It has to cover whichever regimes touch your products, and most exporters with any defense-adjacent line touch both. The cleanest design is one management system built on the EMCP elements with the ITAR-specific obligations (DDTC registration, technical-data controls, 22 CFR 127.12 disclosures) folded into the relevant elements. The jurisdiction review that decides which regime applies has to come first; GingerControl's Export Control Classifier covers only the EAR side after that, so ITAR items need counsel or an ITAR-capable tool.

How does an export compliance program demonstrate "reasonable" compliance to BIS or DDTC?

By producing evidence for each element on demand: a named owner and signed commitment, a documented risk assessment, classification reasoning, screening records, training logs, audit reports, and a disclosure procedure. For an export compliance program owner facing a five-year audit lookback, the binding constraint is usually whether the reasoning trail still exists. GingerControl's classification reports keep the reasoning per item, which supports the recordkeeping and audit elements for classification; the company and its counsel still own the determinations and any filings.

Can software run my export compliance program for me?

No software runs the program; the program is governance, owned by people. Software handles the research-and-documentation load inside specific elements. For a compliance team screening 50 to 200 new SKUs per quarter across mixed commercial and defense-adjacent lines, manual classification and screening is the bottleneck that breaks elements 2, 3, and 6 first. GingerControl's Export Control Classifier speeds up the EAR classification and documents it, but party screening needs its own tool, and the commodity-jurisdiction call, the legal determination, DDTC registration, and any license or disclosure filing remain the exporter's and counsel's responsibility, not the tool's.

Do I need to register with DDTC before my ITAR compliance program is complete?

Registration is a precondition, not a later step. Any U.S. person manufacturing, exporting, or temporarily importing defense articles or furnishing defense services must register with DDTC annually (Statement of Registration, Form DS-2032; Tier 1 fee $3,000 under the December 2024 final rule), even without active exports, and registration is a prerequisite for any DDTC license. GingerControl does not cover the USML, so whether your items fall on it, the registration obligation that follows and the commodity-jurisdiction determination behind it are decisions for the company and its counsel to make and file.

How does an export compliance program handle a voluntary self-disclosure?

Through the handling-and-reporting element (element 8): detect the issue, stop the conduct, investigate, and, where warranted, file a Voluntary Self-Disclosure to BIS (EAR) or a Voluntary Disclosure under 22 CFR 127.12 (ITAR), which the agencies may treat as a mitigating factor. A disclosure is only as strong as the factual record behind it. Classification reports kept per item are part of that factual record, so the classification side of VSD preparation is retrieval rather than reconstruction; the decision to disclose and the filing itself are legal judgments for the exporter and counsel, not actions GingerControl takes.

Standing up the program with one screening and documentation layer

If you are building an export compliance program from the EMCP elements and need elements 2, 3, 4, 7, and 8 to share one reasoning standard and one record, the classification underneath them has to follow the order of review and preserve the trail. GingerControl's Export Control Classifier narrows the CCL to one ECCN, or EAR99, and writes a report your export counsel can check; it works under the EAR only, and party screening runs in a separate tool, while the commodity-jurisdiction call, the legal determination, DDTC registration, and any filing stay with you and your counsel. See the Export Control Classifier →

GingerControl builds GingerOS, the AI trade compliance platform that runs on your process and the data you have, ERP or not. A project starts with Prototype Week, the step before a quote. Talk to our team →

References

1. U.S. Department of Commerce, Bureau of Industry and Security, Core Elements of an Effective Export Management and Compliance Program (EMCP)
   Data cited: the nine EMCP elements (management commitment, risk assessment, export authorization, recordkeeping, training, cradle-to-grave compliance security, monitoring and auditing, handling and reporting violations, follow-through and corrective action)
   Source: BIS, Core Elements of an Effective EMCP
2. U.S. Department of Commerce, Bureau of Industry and Security, Developing an Export Compliance Program (ECP)
   Data cited: BIS definition of an ECP ("a series of procedures and tools that facilitate compliance with export controls to mitigate the risk of export violations"); the eight ECP groupings; who must maintain an ECP
   Source: BIS, Export Compliance Programs (ECPs)
3. U.S. Department of State, Directorate of Defense Trade Controls, ITAR Compliance Program Guidelines (December 5, 2022)
   Data cited: DDTC's elements of an effective ITAR Compliance Program; Compliance Management Commitment Statement signed by senior executive; detect/investigate/disclose procedures and due-diligence best practices
   Source: Sidley Austin, DDTC Compliance Program Guidelines highlight best practices for due diligence
   Published: January 2023 (analyzing the December 5, 2022 DDTC guidelines)
4. U.S. Code of Federal Regulations, Title 22, Voluntary Disclosures (ITAR)
   Data cited: 22 CFR 127.12 voluntary disclosure procedure; disclosure as a mitigating factor; required review of circumstances, corrective actions, and senior-official certification
   Source: 22 CFR 127.12 (Cornell Legal Information Institute)
5. Federal Register, International Traffic in Arms Regulations: Registration Fees (final rule)
   Data cited: DDTC annual registration requirement (Form DS-2032); Tier 1 fee of $3,000 per year effective under the final rule, first increase in fifteen years; registration as a prerequisite for any DDTC license (22 CFR 122.3)
   Source: Federal Register, 89 FR (Dec 10, 2024), DDTC Registration Fees
   Published: December 10, 2024
6. U.S. Code of Federal Regulations, Title 15, EAR Recordkeeping
   Data cited: EAR five-year records retention requirement under 15 CFR Part 762
   Source: 15 CFR Part 762, Recordkeeping (eCFR)
7. U.S. Code of Federal Regulations, Title 22, ITAR Recordkeeping
   Data cited: ITAR five-year records retention requirement under 22 CFR 122.5
   Source: 22 CFR 122.5, Maintenance of records by registrants (eCFR)